Senior AWS Networking & Landing Zone Engineer

Devopsroles; United States; Remote; USD 120,000 - 160,000; Full time

Benefits offered by this job

Health and dental insurance

Meal and food allowance

Childcare assistance

Extended paternity leave

Wellness programs

Job summary

CI&T is seeking an expert to co-own a multi-account AWS network foundation, delivering end-to-end Transit Gateway designs with centralised inspection and secure egress. You will work closely with client cloud architects to justify subnets, routing, and firewall paths, ensuring delivery across multiple accounts and stages.

Ideal candidates have hands-on experience with hub-and-spoke topology, AWS IPAM, Network Firewall, and Terraform, with strong written communication to record decisions and

Qualifications

• Hands-on with hub-and-spoke design and centralized inspection.
• Ability to describe a routing asymmetry you diagnosed or a firewall you had to prove was in the path.
• Experience inheriting a landing zone deployed by others and extending it.
• Knowledge of Transit Gateway, VPC design, PrivateLink, and Route 53 Resolver.

Responsibilities

• Own the network foundation end to end: Transit Gateway with separated inspected and uninspected route tables, VPC design across inspection, egress, ingress, shared services, and workload tiers
• Define and enforce the routing posture that makes traffic pass a firewall rather than merely sit near one
• Verify that posture by test, not by reading your own plan
• Design and implement Transit Gateway Connect over GRE with BGP, two peers for availability
• Extract precise inputs from third-party SD-WAN vendors who are not on your team and do not share your deadline
• Manage AWS IPAM with a delegated organisation administrator, pool hierarchy mapped to accounts, RAM shares to spoke accounts
• Justify every prefix— "it looked tidy" is not an answer
• Implement AWS Network Firewall with stateful rule groups, default drop posture, domain allowlisting, and managed threat signatures
• Be the person who knows whether an application failing to reach the internet is the firewall working correctly
• Write and maintain Terraform across multiple accounts with per-phase state separation, deployed through GitHub OIDC
• Implement drift detection, static validation, and a pipeline that a client can inherit
• Manage log delivery into governance accounts, resource policies, KMS key policies, and service-linked roles
• Understand that these accept broken configurations silently — and prove delivery by watching a log arrive
• Write down why: why a prefix is what it is, why an option was rejected, what a deviation is
• Prevent the next engineer from reversing a deliberate choice because nobody recorded the reasoning

Skills

Transit Gateway

VPC Design

Hub and Spoke

Terraform

AWS Network Firewall

GRE & BGP

Direct Connect

GitHub OIDC

IPAM

English Proficiency

Tools

Terraform

Transit Gateway Connect

RAM

Job description

CI&T is seeking an expert to co-own a multi-account AWS network foundation, delivering end-to-end Transit Gateway designs with centralised inspection and secure egress. You will work closely with client cloud architects to justify subnets, routing, and firewall paths, ensuring delivery across multiple accounts and stages.

Ideal candidates have hands-on experience with hub-and-spoke topology, AWS IPAM, Network Firewall, and Terraform, with strong written communication to record decisions and