Role: Cloud Architect (AWS and Azure)

Location:
Hyderabad, Bangalore, Pune

Experience:
12 to 18 Years Architecture and roadmap:
• Own the target architecture for Codon across AWS and Azure: landing zone, account and subscription structure, network, identity, data, secrets, observability.
• Design and deliver multi-tenancy: tenant isolation at the account, network, data and identity layers; per-tenant cost attribution; tenant onboarding as code.
• Design and deliver disaster recovery and business continuity: RPO and RTO targets per tier, cross-region strategy, backup and restore drills, runbooks that are rehearsed, not written once.
• Define the environment model (dev, test, pilot, production) and the promotion path between them, including the deployment gate that holds a release until its checks Security
• Raise the platform to a documented security posture: least-privilege IAM, workload identity, secret rotation with zero downtime (we already rotate database and gateway keys), private endpoints, egress allow-listing, encryption and key management (KMS and Key Vault).
• Run threat modelling for the platform's trust boundaries, including an AI agent with a shell inside a container, and close the findings.
• Prepare the platform for internal security review and for customer audits (SOC 2 style evidence, logging and retention, access reviews). Build and operate
• Write and review the Terraform (modules, environment roots, policy as code). Everything is code; nothing is clicked in a console.
• Own the CI/CD and release tooling with the product team: image builds, SBOMs, the deployer, evidence capture.
• Set up observability that answers questions in minutes: central logging, metrics, tracing, alerting, cost dashboards.
• Lead incident analysis across teams. Recent examples from our own log: a rotated database password that silently broke recent connections, an egress path that drops for hours on a shared security gateway,



a load balancer whose private addresses changed under a fixed route. Work with others
• Be the single technical contact for UST's Network, Cloud, Security, Identity and AI gateway teams; turn their constraints into designs and their requests into tickets with evidence.
• Pair with the product engineers daily. Review their infrastructure changes, teach them the platform's rules, and keep the design records current.
• Guide one or two platform engineers as the team grows. What you bring

Experience:
12+ years in software or infrastructure engineering, of which at least 10 years hands-on in public cloud, with production ownership on both AWS and Azure. Depth on one, real delivery on the other.
• You have designed and operated at least one multi-tenant SaaS platform and at least one cross-region DR setup, and you can describe what broke in each.
• You have written Terraform for years, not months. You can read a plan and tell what will be replaced and why. Technical
• AWS: VPC design, Transit Gateway, PrivateLink, ECS or EKS, RDS, EFS, ALB and NLB, IAM, KMS, Secrets Manager, CloudWatch, Route 53, Organizations and SCPs.
• Azure: Entra ID (enterprise apps, SAML and OIDC, conditional access), Key Vault with private endpoints, VNets and Private Link, Azure Policy, hybrid connectivity.
• Networking: routing across cloud and on-premises, SD-WAN and security gateways such as Zscaler, TLS and certificate lifecycle, DNS split-horizon.
• Security: zero trust principles, workload identity, secret rotation, container hardening, audit logging, compliance evidence.




• Containers and delivery: Docker, Fargate or Kubernetes, blue/green and canary deployments, GitHub Actions or equivalent, SBOM and vulnerability management.
• Comfortable reading application code (TypeScript or Python) well enough to find where an infrastructure assumption lives. Ways of working
• You write things down: decision records, runbooks, incident reports with evidence. You prefer a diagram and a table to a meeting.
• You test in production-like conditions and rehearse failures before they happen.
• You are direct with other teams about what is theirs and what is ours, with the logs to show it. Certifications (any two, or equivalent demonstrated experience)
• AWS Solutions Architect Professional or DevOps Engineer Professional
• Microsoft Azure Solutions Architect Expert (AZ-305)
• A security credential such as AWS Security Specialty, AZ-500 or CCSP Nice to have:
• Experience hosting LLM or agent workloads: gateways, key brokering, cost metering per user, isolation of agent sandboxes.
• Enterprise platform background: ServiceNow, Salesforce or SAP integration patterns.
• FinOps practice: cost allocation by tenant, rightsizing, commitment planning.
• Exposure to regulated environments and customer audits. First six months, what success looks like
• A written target architecture for multi-tenant Codon on AWS and Azure, reviewed with Security and Network, with a sequenced plan.
• Production environment stood up as code with the deployment gate, logging, alerting and cost reporting in place.
• A DR design with targets agreed, and the first restore drill completed and documented.
• The current security findings closed, secret rotation proven without downtime, and an audit evidence pack that a reviewer can read.
• Standing working agreements with the Network, Identity and AI gateway teams, with named contacts and response expectations.

📌 Cloud Architect (Hyderabad)
🏢 UST
📍 Hyderabad