AWS Cloud Platform SME

Your tasks

Landing Zone and Account Management

• Design, build, and manage the enterprise AWS landing zone using AWS Control Tower, AWS Organizations, and Service Control Policies.
• Own account vending, organizational unit structure, and account lifecycle management (Account Factory / AFT).

• Manage centralized identity and access using AWS IAM Identity Center, federation with Azure AD/Okta, and permission set governance.

Platform Networking

• Design and manage hub-and-spoke network architecture using Transit Gateway, VPC, Direct Connect, Site-to-Site VPN, and PrivateLink.
• Manage hybrid DNS with Route 53 Resolver, IP address management (VPC IPAM), and network segmentation.

• Oversee centralized ingress/egress, AWS Network Firewall, WAF, and Shield.

Shared Services and Platform Operations

• Manage shared platform services including logging, monitoring, backup, patching, and directory services.
• Oversee AMI lifecycle and golden image pipelines using EC2 Image Builder.

• Manage patching, inventory, and automation with AWS Systems Manager (Patch Manager, State Manager, Session Manager).
• Implement centralized backup and retention policies using AWS Backup.

• Manage platform capacity, service quotas, and limits across accounts.

Platform Governance, Security, and Compliance

• Define and enforce platform guardrails using SCPs, AWS Config conformance packs, and Control Tower controls.
• Manage centralized security services: GuardDuty, Security Hub, CloudTrail (organization trail), Inspector, Macie, and IAM Access Analyzer.

• Manage encryption and key governance with AWS KMS.
• Ensure compliance with MAS TRM, PDPA, ISO 27001, and CIS AWS Foundations Benchmark.

Platform Services Catalog and Enablement

• Build and maintain a standardized service catalog using AWS Service Catalog or Terraform modules.
• Define platform standards, reference architectures, and onboarding patterns for application teams.

• Act as the technical authority and escalation point for AWS platform issues.

Platform Resilience and Cost Governance

• Design multi-region resilience and DR patterns for platform services.
• Oversee platform-level cost governance using Cost Explorer, AWS Budgets, Compute Optimizer, Savings Plans, and tagging policies.

• Track AWS service updates and evaluate their impact on the platform.

Requirements

Technical Skills Required

• 12–15 years in IT infrastructure, with at least 8 years of hands-on AWS platform experience.
• Expert knowledge of AWS Control Tower, Organizations, SCPs, and multi-account architecture.

• Deep expertise in AWS networking (Transit Gateway, Direct Connect, Route 53 Resolver, PrivateLink).
• Strong experience with AWS Systems Manager, EC2 Image Builder, AWS Backup, and centralized logging.

• Strong knowledge of AWS security and governance services.
• Proficiency in Terraform or CloudFormation for platform automation.

• Scripting skills in Python or Bash.

Good to Have

• AWS Certified Solutions Architect – Professional, Advanced Networking – Specialty, or Security – Specialty.
• HashiCorp Terraform Associate certification.

• Experience in government environments in Singapore.