• 
  Own the multi-account AWS Organization design: OU structure, account vending, Service Control Policies, Control Tower guardrails, and IAM Identity Center for SSO.
• 
  Own network architecture — Transit Gateway hub-and-spoke, VPC design and segmentation, PrivateLink, DNS, and cross-account connectivity — designed for multi-region and multi-tenant growth.
• 
  Design the security architecture and keep it coherent as services multiply: IAM boundaries and least privilege, KMS key strategy, org-wide CloudTrail, GuardDuty/Security Hub/Inspector/Macie, and WAF/Shield at the edge.
• 
  Define reference architectures and standards for new services so the tenth service built looks like the first. Author and maintain architecture documentation.
• 
  Lead the EKS adoption path: Fargate vs. managed node groups, IRSA, cluster networking, and which workloads belong in containers vs. staying serverless.
• 
  Own AWS Well-Architected reviews and drive remediation. Own cloud cost architecture — tagging strategy, chargeback by workload, and commitment planning.
• 
  Own the Terraform/OpenTofu codebase end to end: module design, versioning, registry strategy, state management, and Terragrunt configuration across environments and accounts.
• 
  Enforce IaC quality through policy-as-code (OPA/Sentinel or equivalent), automated plan review, drift detection, and remediation.
• 
  Eliminate console-created resources — everything that exists should exist in code.
• 
  Mentor engineers on IaC patterns and review infrastructure changes.
• 
  Own the lakehouse architecture: S3 Bronze/Silver/Gold zones, partitioning and file-format strategy, Glue Data Catalog, Lake Formation governance, and Databricks integration.
• 
  Design, build, and maintain ETL and ELT pipelines ingesting from CRM/DMS systems, call data, payment systems, inventory feeds, and OEM sources — using AWS Glue, Lambda, Step Functions, EventBridge, and Databricks as appropriate.
• 
  Own data quality: validation at ingestion, schema evolution, reconciliation, late and duplicate record handling, and alerting when a feed goes quiet or goes wrong.
• 
  Design change-data-capture and incremental-load patterns; move off full reloads where they still exist.
• 
  Own the Aurora footprint (MySQL and PostgreSQL/pgvector), including schema design, performance tuning, and serverless scaling configuration.
• 
  Build the data lineage and cataloging practice so analysts and scientists can answer "where did this number come from" without asking a person.
• 
  Design pipelines with downstream ML consumption in mind — reproducible features, stable definitions, and backfill capability.
• 
  Define and enforce data retention, PII classification, and access control policy across the lake, with particular care around call recordings, payment data, and customer records.
• 
  Support PCI-relevant scoping and segmentation decisions on the payment path.

Requirements

• 
  5+ years in cloud engineering with at least 4 years focused on AWS architecture.
• 
  Expert-level Terraform or OpenTofu (module authorship, state strategy, and multi-account patterns).
• 
  Demonstrated multi-account AWS design experience (Organizations, Control Tower, SCPs, Transit Gateway, IAM Identity Center).
• 
  Strong hands-on ETL/data engineering background using AWS Glue, Spark, Step Functions, and Python.
• 
  Experience designing data lakes or lakehouses, including Bronze/Silver/Gold architecture and governance using Lake Formation or similar.
• 
  Deep serverless experience with Lambda, API Gateway, EventBridge, SQS/SNS, and Aurora Serverless.
• 
  Strong SQL and relational data modeling skills, including performance tuning on Aurora or similar managed databases.
• 
  Strong security architecture knowledge, including IAM, KMS, network segmentation, and AWS security services.
• 
  Ability to write clear technical design documents that engineers can implement without additional clarification.

• 
  Terragrunt experience (strongly preferred).
• 
  Databricks and Delta Lake production experience.
• 
  EKS design and migration experience, including EC2-to-container migration with minimal downtime.
• 
  Experience with streaming and CDC tools such as Kinesis, MSK, DMS, or Debezium.
• 
  Automotive retail data integration experience (Tekion, CDK, Reynolds, Dealertrack, VinSolutions, or similar DMS/CRM platforms).
• 
  PCI DSS scoping and compliance architecture experience.
• 
  AWS certifications (Solutions Architect – Professional, Data Engineer, or Security Specialty).
• 
  Experience supporting ML and RAG workloads, including vector store design

Benefits