Senior Cloud Operations Specialist

Job Description

Position Summary

The Senior Cloud Operations Specialist is a senior technical owner for the stability, security, governance, and resilience of Assent's enterprise AWS environment and SaaS production systems. The role combines hands-on cloud operations with solution architecture, technical leadership, and sound risk-based decision making across a large multi-account AWS estate.

Working within the SaaS Product Infrastructure group, this individual partners with Engineering, Product, Corporate Security, and IT to design and operate secure, highly available cloud services. The successful candidate works independently at a high level, turns business and technical requirements into practical solutions, and constructively challenges decisions that introduce unnecessary risk, operational burden, or architectural debt.

This role follows a strict code-first and least-privilege operating model. Infrastructure changes are codified, peer-reviewed, and delivered through approved pipelines. Privileged access is exceptional, time-bound, auditable, and used only when required.

Responsibilities

Architecture Technical Leadership and Decision Making

• Lead the design and delivery of secure, scalable, resilient, and supportable AWS solutions from initial requirements through production operation.

• Translate business, security, compliance, and operational requirements into architecture decisions, implementation plans, and reusable platform patterns.

• Evaluate technical options and make clear, risk-based recommendations that balance security, reliability, maintainability, delivery speed, and cost.

• Question assumptions and respectfully challenge designs or delivery approaches that conflict with enterprise standards, least-privilege principles, reliability objectives, or long-term platform health.

• Participate in architecture and design reviews, document key decisions and tradeoffs, and ensure operational readiness before production adoption.

• Act as a senior technical escalation point, lead complex infrastructure initiatives, and coach team members through design and operational decisions.

AWS Platform Governance Identity and Privileged Access

• Own and continuously improve Assent's AWS multi-account environment using AWS Organizations, AWS Control Tower, organizational units, account lifecycle controls, guardrails, and Service Control Policies.

• Architect and operate AWS IAM Identity Center, IAM roles and policies, permission sets, trust relationships, permission boundaries, federation, and cross-account access patterns.

• Apply least privilege by default. Ensure elevated access is approved, time-bound where supported, protected by strong authentication, logged, regularly reviewed, and separated from day-to-day identities.

• Maintain controlled break-glass access and prevent shared credentials, unmanaged access paths, unnecessary standing privilege, and unreviewed administrative changes.

• Lead account provisioning, compliance assessments, access reviews, drift detection, and remediation across the AWS organization.

• Partner with Corporate Security on identity governance, audit readiness, cloud control design, and the implementation of enterprise security requirements.

Enterprise AWS Networking

• Design, operate, and troubleshoot enterprise AWS network architectures across accounts and regions, including VPCs, subnets, route tables, security groups, network ACLs, and shared network services.

• Own connectivity and traffic-flow patterns using services such as Transit Gateway, VPC peering, PrivateLink, VPN, Direct Connect, Route 53, Elastic Load Balancing, API Gateway, and CloudFront.

• Design secure ingress, egress, segmentation, DNS, and service-to-service connectivity patterns using AWS Network Firewall, AWS WAF, VPC endpoints, flow logs, and centralized inspection where appropriate.

• Diagnose complex routing, name resolution, load-balancing, firewall, latency, and cross-account connectivity issues and drive permanent corrective action.

• Maintain current network diagrams, traffic-flow documentation, connectivity standards, and recovery procedures.

Infrastructure as Code Automation and Delivery

• Provision and govern AWS platform resources through Terraform using reusable modules, secure remote state, controlled workspaces, and maintainable multi-account patterns.

• Use GitHub Actions as the primary delivery mechanism for infrastructure and governance changes, with peer review, validation, security checks, approvals, and traceable deployment records.

• Uphold a no unmanaged changes standard. Use AWS console access only for approved operational needs, and codify or reconcile any necessary emergency change promptly.

• Build automation with Python, PowerShell, Bash, Lambda, Ansible, Semaphore, or similar tools to reduce manual effort, enforce consistency, and improve recovery time.

• Review infrastructure code and automation for security, reliability, maintainability, and alignment with enterprise standards.

Cloud Operations Reliability and Incident Response

• Operate and improve core AWS services across compute, containers, databases, storage, messaging, DNS, content delivery, security, and monitoring.

• Install, configure, secure, patch, and troubleshoot Linux and Windows workloads in cloud environments.

• Establish effective monitoring, logging, alerting, dashboards, and automated remediation using CloudWatch, OpenSearch or Elasticsearch, New Relic, PagerDuty, or comparable platforms.

• Lead or support high-severity incident response, communicate clearly under pressure, restore service safely, and coordinate across technical and business teams.

• Conduct root-cause analysis and ensure corrective actions address underlying technical and process failures rather than only immediate symptoms.

• Participate in the on-call rotation and planned off-hours work required to support production infrastructure.

Security Compliance Resilience and Operational Ownership

• Maintain enterprise standards for encryption, key management, audit logging, configuration compliance, vulnerability remediation, and evidence collection using services such as KMS, CloudTrail, and AWS Config.

• Support internal and external audits and provide clear evidence of cloud controls, access governance, and operational processes.

• Design, implement, and test backup, business continuity, disaster recovery, and multi-region resilience capabilities.

• Create and maintain accurate documentation for cloud architecture, governance controls, operational procedures, automation workflows, and support handoffs.

• Take end-to-end ownership of assigned platforms and initiatives, surface risks early, and follow decisions through implementation and operational acceptance.

Qualifications

Minimum Requirements

• 7 or more years of relevant experience in cloud operations, platform engineering, infrastructure engineering, or systems administration, including substantial hands-on responsibility for enterprise AWS environments.

• Proven long-term ownership of a multi-account AWS organization using AWS Organizations, AWS Control Tower, and AWS IAM Identity Center.

• Deep experience with enterprise AWS governance, including organizational design, account provisioning, Service Control Policies, guardrails, configuration compliance, and drift remediation.

• Advanced knowledge of AWS identity and access management, including least privilege, privileged-access controls, federation, cross-account access, permission sets, IAM policies and roles, and emergency access practices.

• Strong AWS networking experience, including multi-account and multi-region network design, routing, DNS, load balancing, private connectivity, segmentation, and network security controls.

• Strong Terraform experience, including reusable modules, multi-account deployment patterns, secure remote state in Amazon S3, code review, testing, and lifecycle management.

…