Role: Cloud Architect (AWS and Azure)

Location: Hyderabad, Bangalore, Pune

Experience: 12 to 18 Years

Architecture and roadmap

- Own the target architecture for Codon across AWS and Azure: landing zone, account and subscription structure, network, identity, data, secrets, observability.
- Design and deliver multi-tenancy: tenant isolation at the account, network, data and identity layers; per-tenant cost attribution; tenant onboarding as code.
- Design and deliver disaster recovery and business continuity: RPO and RTO targets per tier, cross-region strategy, backup and restore drills, runbooks that are rehearsed, not written once.
- Define the environment model (dev, test, pilot, production) and the promotion path between them, including the deployment gate that holds a release until its checks Security
- Raise the platform to a documented security posture: least-privilege IAM, workload identity, secret rotation with zero downtime (we already rotate database and gateway keys), private endpoints, egress allow-listing, encryption and key management (KMS and Key Vault).
- Run threat modelling for the platform's trust boundaries, including an AI agent with a shell inside a container, and close the findings.
- Prepare the platform for internal security review and for customer audits (SOC 2 style evidence, logging and retention, access reviews).

Build and operate

- Write and review the Terraform (modules, setting roots, policy as code). Everything is code; nothing is clicked in a console.
- Own the CI/CD and release tooling with the product team: image builds, SBOMs, the deployer, evidence capture.
- Set up observability that answers questions in minutes: central logging, metrics, tracing, alerting, cost dashboards.
- Lead incident analysis across teams. Recent examples from our own log: a rotated database password that silently broke new connections, an egress path that drops for hours on a shared security gateway,



a load balancer whose private addresses changed under a fixed route.

Work with others
- Be the single technical contact for UST's Network, Cloud, Security, Identity and AI gateway teams; turn their constraints into designs and their requests into tickets with evidence.
- Pair with the product engineers daily. Review their infrastructure changes, teach them the platform's rules, and keep the design records current.
- Guide one or two platform engineers as the team grows.

What you bring

Experience: 12+ years in software or infrastructure engineering, of which at least 10 years hands-on in public cloud, with production ownership on both AWS and Azure. Depth on one, real delivery on the other.

- You have designed and operated at least one multi-tenant SaaS platform and at least one cross-region DR setup, and you can describe what broke in each.
- You have written Terraform for years, not months. You can read a plan and tell what will be replaced and why.

Technical

- AWS: VPC design, Transit Gateway, PrivateLink, ECS or EKS, RDS, EFS, ALB and NLB, IAM, KMS, Secrets Manager, CloudWatch, Route 53, Organizations and SCPs.
- Azure: Entra ID (enterprise apps, SAML and OIDC, conditional access), Key Vault with private endpoints, VNets and Private Link, Azure Policy, hybrid connectivity.
- Networking: routing across cloud and on-premises, SD-WAN and security gateways such as Zscaler, TLS and certificate lifecycle, DNS split-horizon.
- Security: zero trust principles, workload identity, secret rotation, container hardening, audit logging, compliance evidence.




- Containers and delivery: Docker, Fargate or Kubernetes, blue/green and canary deployments, GitHub Actions or equivalent, SBOM and vulnerability management.
- Comfortable reading application code (TypeScript or Python) well enough to find where an infrastructure assumption lives.

Ways of working
- You write things down: decision records, runbooks, incident reports with evidence. You prefer a diagram and a table to a meeting.
- You test in production-like conditions and rehearse failures before they happen.
- You are direct with other teams about what is theirs and what is ours, with the logs to show it.

Certifications (any two, or equivalent demonstrated experience)
- AWS Solutions Architect Professional or DevOps Engineer Professional
- Microsoft Azure Solutions Architect Expert (AZ-305)
- A security credential such as AWS Security Specialty, AZ-500 or CCSP

Nice to have:

- Experience hosting LLM or agent workloads: gateways, key brokering, cost metering per user, isolation of agent sandboxes.
- Enterprise platform background: ServiceNow, Salesforce or SAP integration patterns.
- FinOps practice: cost allocation by tenant, rightsizing, commitment planning.
- Exposure to regulated environments and customer audits.

First six months, what success looks like
1. A written target architecture for multi-tenant Codon on AWS and Azure, reviewed with Security and Network, with a sequenced plan.
2. Production environment stood up as code with the deployment gate, logging, alerting and cost reporting in place.
3. A DR design with targets agreed, and the first restore drill completed and documented.
4. The current security findings closed, secret rotation proven without downtime, and an audit evidence pack that a reviewer can read.
5. Standing working agreements with the Network, Identity and AI gateway teams, with named contacts and response expectations.

📌 Cloud Architect (AWS and Azure) (Hyderabad)
🏢 UST
📍 Hyderabad