Cloud Engineer (Google Cloud)

NexGen Tech Solutions; Plano (TX); In loco; USD 120.000 - 160.000; Tempo pieno

Descrizione del lavoro

NexGen Tech Solutions is seeking a cloud identity engineer to design and implement GCP IAM as code across orgs, folders and projects. You will work with Terraform, establish least-privilege role sets, and align access with policy.

You'll also manage Workforce Identity Federation and Workload Identity Federation, ensuring machine and human identities access GCP via secure token flows, while phasing out static keys.

Competenze

• Strong hands-on Terraform for IAM
• Deep knowledge of GCP IAM policy model and inheritance
• Experience with workforce identity federation
• Experience with workload identity federation
• Lifecycle management of service accounts and keys
• Ability to design reusable role entitlements
• Experience operating CI/CD pipelines for IAM changes

Mansioni

• Design and deliver GCP IAM as code across organisation, folder and project scope.
• Manage entitlements behind Workforce Identity Federation so access is declared in code.
• Wire up Workload Identity Federation for applications and pipelines to use federated tokens.
• Own the service-account lifecycle: naming, provisioning, impersonation, and key elimination.
• Design reusable role models mapping teams to needed access to ensure repeatable permissions.
• Review access requests against least-privilege standards and document decisions.

Conoscenze

Terraform

GCP IAM

Workforce Identity Federation

Workload Identity Federation

Service account lifecycle

Role modeling

CI/CD pipelines

Descrizione del lavoro

• Design and deliver GCP IAM as code — role bindings, custom roles and least-privilege role sets across organisation, folder and project scope — authored in Terraform, peer-reviewed and applied by pipeline.
• Manage the entitlements behind Workforce Identity Federation, so enterprise users reach GCP through the firm’s identity provider with their access declared in code rather than granted by hand.
• Wire up Workload Identity Federation for applications and pipelines — binding federated principals onto service accounts so a workload exchanges a token for GCP access instead of holding a key.
• Own the service-account lifecycle: naming, provisioning, ownership, impersonation, and the elimination of static keys.
• Design the role model— the reusable sets of entitlements that map a team or persona to the access it actually needs, so access is repeatable and reviewable instead of bespoke.
• Review access requests against a least-privilege standard: establish what a role genuinely grants, find the tightest role that meets the stated need, and record the decision.

What You’ll Do

• Design and deliver GCP IAM as code — role bindings, custom roles and least-privilege role sets across organisation, folder and project scope — authored in Terraform, peer-reviewed and applied by pipeline.
• Manage the entitlements behind Workforce Identity Federation, so enterprise users reach GCP through the firm’s identity provider with their access declared in code rather than granted by hand.
• Wire up Workload Identity Federation for applications and pipelines — binding federated principals onto service accounts so a workload exchanges a token for GCP access instead of holding a key.
• Own the service-account lifecycle: naming, provisioning, ownership, impersonation, and the elimination of static keys.
• Design the role model— the reusable sets of entitlements that map a team or persona to the access it actually needs, so access is repeatable and reviewable instead of bespoke.
• Review access requests against a least-privilege standard: establish what a role genuinely grants, find the tightest role that meets the stated need, and record the decision.

Required

What we’re looking for

• Strong hands-on Terraform — authoring, reviewing and shipping IAM through modules and CI/CD.
• Strong hands-on GCP IAM — the policy model, inheritance across organisation, folder and project, and the practical difference between predefined and custom roles.
• Real depth on roles and permissions: able to work out what a role actually confers, spot an over-grant, and substitute a narrower role without breaking the use case.
• Ability to understand Workforce Identity Federation and Workload Identity Federation — how human access federates into GCP from an enterprise identity provider, and how a machine identity exchanges a federated token for GCP access instead of holding a key.

Nice to have

• IAM deny policies.
• IAM Conditions — conditional role bindings.
• Experience removing service-account keys at scale, or running a keyless migration.
• Custom role design and the governance around it.
• Experience operating in large regulated enterprise environments.