Lead Cloud Platform Engineer - AWS Control Tower & Service Enablement

The Role at a Glance

We are seeking a highly motivated Lead Cloud Platform Engineer to join our Cloud Engineering team, with a primary focus on AWS Control Tower, enterprise landing zone engineering, and the secure enablement of AWS services. This is an enterprise cloud platform engineering role, not an application development or application-focused DevOps position. The engineer will build, govern, automate, and operate the shared AWS foundation used by multiple application teams, including landing zones, account provisioning, platform controls, and approved cloud and AI services, including Amazon Bedrock AgentCore.

The successful candidate will possess hands-on ownership experience with a shared enterprise AWS platform, deep practical AWS Control Tower knowledge and implementation experience, a demonstrated ability to take AWS services from evaluation through production enablement, and working knowledge of Amazon Bedrock AgentCore. Strong software development and automation skills applied to reusable platform capabilities, experience with AI and machine learning technologies, and excellent written and verbal communication skills are essential. This position does not include direct people management responsibilities but requires strong technical influence and collaboration across stakeholders.

What you'll be doing

• Lead the design, implementation, automation, and ongoing operation of AWS Control Tower and enterprise landing zones, including multi-account structures, organizational units, account provisioning and enrollment, baseline configurations, landing zone upgrades, and drift remediation.
• Implement and maintain AWS Control Tower controls and account governance in partnership with security teams, integrating AWS Organizations, service control policies (SCPs), IAM Identity Center, AWS Config, and centralized logging.
• Drive end-to-end AWS service enablement: assess use cases and dependencies, coordinate architecture and security reviews, define approved configurations and access patterns, build reusable Infrastructure as Code, validate controls, and deliver production-ready services with documented support ownership.
• Develop and maintain cloud automation using Python and Infrastructure as Code to standardize account provisioning, landing zone configurations, service deployment, and ongoing platform lifecycle management.
• Build and enhance GitLab CI/CD pipelines for shared platform infrastructure, account baselines, and reusable AWS service enablement patterns.
• Evaluate, enable, and support AI and machine learning capabilities, with particular emphasis on enabling Amazon Bedrock AgentCore as a governed enterprise platform capability. Develop shared deployment patterns, access controls, observability, and support boundaries for Runtime, Gateway, Identity, Memory, and Observability in partnership with AI, application, architecture, and security teams. The focus is enabling application teams to build and operate agents, not primarily developing application-specific agents.
• Partner with architects, developers, security teams, and operations teams to deliver shared cloud platform capabilities and approved service patterns that application teams can consume.
• Implement cloud best practices related to security, scalability, resiliency, and operational excellence.
• Troubleshoot and resolve complex issues in the shared AWS platform, including account provisioning, governance controls, identity integrations, and service enablement; collaborate with application teams to distinguish platform issues from application-owned issues.
• Drive continuous improvement initiatives across cloud engineering processes and tooling.

Technical Skills

Cloud & Platform

• AWS / AWS Control Tower
• Landing Zone
• AWS Organizations, organizational units, SCPs, IAM Identity Center, AWS Config, & AWS CloudTrail
• EC2
• S3
• VPC
• IAM
• Lambda
• API Gateway
• EKS
• ECS/Fargate
• RDS
• CloudWatch
• Splunk
• SNOW

Development & Automation

• Python
• GitLab
• CI/CD Pipelines
• AWS CDK
• CloudFormation
• REST APIs
• Reusable service enablement modules, account baseline automation, & automated configuration validation

AI & Machine Learning

• Amazon Bedrock AgentCore: Runtime, Gateway, Identity, Memory, and Observability
• SageMaker
• Generative AI
• Prompt Engineering
• AI/ML Workflows
• Agent-Based Solutions

Enterprise Tools

• ServiceNow
• Jira
• Confluence

What we’re looking for

Must-haves:

• 5-10 years of experience in Cloud Engineering, DevOps, Platform Engineering, or related roles, including demonstrated hands-on ownership and engineering of a shared, enterprise-wide AWS platform supporting multiple accounts and application teams. Experience must include platform-level configuration, governance, automation, lifecycle management, and operational support. Experience limited to developing, deploying, or supporting applications within an existing AWS environment does not meet this requirement.
• Deep hands-on experience implementing, administering, and troubleshooting AWS Control Tower in an enterprise multi-account environment; practical experience with landing zone lifecycle management, Account Factory, account enrollment, organizational units, controls, and drift remediation is required.
• Demonstrated experience enabling AWS services for enterprise use, including technical evaluation, architecture and security review, automated deployment patterns, testing, documentation, and operational readiness—not solely deploying services for individual applications.
• Working knowledge of Amazon Bedrock AgentCore, including the purpose and integration considerations of Runtime, Gateway, Identity, Memory, and Observability, and an understanding of platform responsibilities versus application-owned agent logic.
• Strong Python development and automation skills.
• Experience building and maintaining GitLab CI/CD pipelines.
• Experience with AI and Machine Learning technologies and platforms.
• Strong understanding of AWS architecture, cloud networking, security, and multi-account governance, including AWS Organizations, SCPs, IAM Identity Center, least-privilege access, AWS Config, and AWS CloudTrai