AWS Cloud Platform SME

Landing Zone and Account Management • Design, build, and manage the enterprise AWS landing zone using AWS Control Tower, AWS Organizations, and Service Control Policies. • Own account vending, organizational unit structure, and account lifecycle management (Account Factory / AFT). • Manage centralized identity and access using AWS IAM Identity Center, federation with Azure AD/Okta, and permission set governance.

Platform Networking • Design and manage hub-and-spoke network architecture using Transit Gateway, VPC, Direct Connect, Site-to-Site VPN, and Private

Link. • Manage hybrid DNS with Route 53 Resolver, IP address management (VPC IPAM), and network segmentation. • Oversee centralized ingress/egress, AWS Network Firewall, WAF, and Shield.

Shared Services and Platform Operations • Manage shared platform services including logging, monitoring, backup, patching, and directory services. • Oversee AMI lifecycle and golden image pipelines using EC2 Image Builder. • Manage patching, inventory, and automation with AWS Systems Manager (Patch Manager, State Manager, Session Manager).

• Implement centralized backup and retention policies using AWS Backup. • Manage platform capacity, service quotas, and limits across accounts. Platform Governance, Security, and Compliance • Define and enforce platform guardrails using SCPs, AWS Config conformance packs, and Control Tower controls.

• Manage centralized security services: Guard

Duty, Security Hub, Cloud

Trail (organiza