Architect I - Cloud Infrastructure Services

Cloud Architect, Codon Platform (AWS and Azure) Location: UST Hyderabad Type: Full time, in-house About the role Codon is UST's governed developer platform: a web chat and a browser terminal that put Claude to work on ServiceNow and other enterprise platforms, with every write audited, every secret brokered, and every destination controlled at the network edge. It runs today on AWS (ECS Fargate, RDS PostgreSQL, EFS, internal ALB with blue/green deployments, a Squid egress tier) with Azure for identity (Entra) and Key Vault, reached over a transit gateway, SD-WAN and Zscaler. We are hiring the person who owns this architecture end to end and takes it from a single-tenant dev and pilot footprint to a secure, multi-tenant, resilient product. You will be the technical authority for infrastructure, the counterpart to our network, security, identity and AI gateway teams, and the hands that write the Terraform. What you will do Architecture and roadmap o Own the target architecture for Codon across AWS and Azure: landing zone, account and subscription structure, network, identity, data, secrets, observability. o Design and deliver multi-tenancy: tenant isolation at the account, network, data and identity layers; per-tenant cost attribution; tenant onboarding as code. o Design and deliver disaster recovery and business continuity: RPO and RTO targets per tier, cross-region strategy, backup and restore drills, runbooks that are rehearsed, not written once. o Define the environment model (dev, test, pilot, production) and the promotion path between them, including the deployment gate that holds a release until its checks o Security o Raise the platform to a documented security posture: least-privilege IAM, workload identity, secret rotation with zero downtime (we already rotate database and gateway keys), private endpoints, egress allow-listing, encryption and key management (KMS and Key Vault). o Run threat modelling for the platform's trust boundaries, including an AI agent with a shell inside a container, and close the findings. o Prepare the platform for internal security review and for customer audits (SOC 2 style evidence, logging and retention, access reviews). Build and operate o Write and review the Terraform (modules, environment roots, policy as code). Everything is code; nothing is clicked in a console. o Own the CI/CD and release tooling with the product team: image builds, SBOMs, the deployer, evidence capture. o Set up observability that answers questions in minutes: central logging, metrics, tracing, ing, cost dashboards. o Lead incident analysis across teams. Recent examples from our own log: a rotated database password that silently broke new connections, an egress path that drops for hours on a shared security gateway, a load balancer whose private addresses changed under a fixed route. Work with others o Be the single technical contact for UST's Network, Cloud, Security, Identity and AI gateway teams; turn their constraints into designs and their requests into tickets with evidence. o Pair with the product engineers daily. Review their infrastructure changes, teach them the platform's rules, and keep the design records current. o Guide one or two platform engineers as the team grows. What you bring Experience o 12 to 14 years in software or infrastructure engineering, of which at least 10 years hands-on in public cloud, with production ownership on both AWS and Azure. Depth on one, real delivery on the other. o You have designed and operated at least one multi-tenant SaaS platform and at least one cross-region DR setup, and you can describe what broke in each. o You have written Terraform for years, not months. You can read a plan and tell what will be replaced and why. Technical o AWS: VPC design, Transit Gateway, PrivateLink, ECS or EKS, RDS, EFS, ALB and NLB, IAM, KMS, Secrets Manager, CloudWatch, Route 53, Organizations and SCPs. o Azure: Entra ID (enterprise apps, SAML and OIDC, conditional access), Key Vault with private endpoints, VNets and Private Link, Azure Policy, hybrid connectivity. o Networking: routing across cloud and on-premises, SD-WAN and security gateways such as Zscaler, TLS and certificate lifecycle, DNS split-horizon. o Security: zero trust principles, workload identity, secret rotation, container hardening, audit logging, compliance evidence. o Containers and delivery: Docker, Fargate or Kubernetes, blue/green and canary deployments, GitHub Actions or equivalent, SBOM and vulnerability management. o Comfortable reading application code (TypeScript or Python) well enough to find where an infrastructure assumption lives. Ways of working o You write things down: decision records, runbooks, incident reports with evidence. You prefer a diagram and a table to a meeting. o You test in production-like conditions and rehearse failures before they happen. o You are direct with other teams about what is theirs and what is ours, with the logs to show it. Certifications (any two, or equivalent demonstrated experience) o AWS Solutions Architect Professional or DevOps Engineer Professional o Microsoft Azure Solutions Architect Expert (AZ-305) o A security credential such as AWS Security Specialty, AZ-500 or CCSP Nice to have o Experience hosting LLM or agent workloads: gateways, key brokering, cost metering per user, isolation of agent sandboxes. o Enterprise platform background: ServiceNow, Salesforce or SAP integration patterns. o FinOps practice: cost allocation by tenant, rightsizing, commitment planning. o Exposure to regulated environments and customer audits. First six months, what success looks like 1. A written target architecture for multi-tenant Codon on AWS and Azure, reviewed with Security and Network, with a sequenced plan. 2. Production environment stood up as code with the deployment gate, logging, ing and cost reporting in place. 3. A DR design with targets agreed, and the first restore drill completed and documented. 4. The current security findings closed, secret rotation proven without downtime, and an audit evidence pack that a reviewer can read. 5. Standing working agreements with the Network, Identity and AI gateway teams, with named contacts and response expectations.