Architect I - Cloud Infrastructure Services

UST Hyderabad is seeking an experienced Cloud Architect to lead the end-to-end architecture and evolution of Codon, UST’s governed developer platform. Codon integrates web chat and browser terminal capabilities to leverage AI on enterprise platforms like ServiceNow, operating primarily on AWS with Azure handling identity and key management. The role involves transforming Codon from a single-tenant pilot environment into a secure, multi-tenant, resilient product. As the technical authority, you will collaborate closely with network, security, identity, and AI gateway teams, while owning the infrastructure codebase and driving platform reliability and security.

Key Responsibilities

- Own and define the target architecture for Codon across AWS and Azure, including landing zones, account and subscription structures, networking, identity, data, secrets, and observability.
- Design and implement multi-tenancy with tenant isolation at account, network, data, and identity layers, including cost attribution and tenant onboarding automation.
- Develop and maintain disaster recovery and business continuity strategies, setting RPO and RTO targets, cross-region failover plans, and conducting regular backup and restore drills with well-rehearsed runbooks.
- Establish environment models (development, testing, pilot, production) and manage deployment gates to ensure quality and security controls before releases.
- Elevate platform security posture by enforcing least-privilege IAM, workload identity, zero-downtime secret rotation, private endpoints, egress allow-listing, encryption, and key management.
- Conduct threat modeling for platform trust boundaries, including AI agent containers, and address identified risks.
- Prepare the platform for internal security reviews and customer audits by maintaining SOC 2-style evidence, logging, retention policies, and access reviews.
- Write and review Terraform code for infrastructure provisioning, policy as code, and environment management, ensuring all changes are code-driven.
- Manage CI/CD pipelines and release tooling, including image builds, SBOM generation, deployment automation, and evidence capture.
- Implement observability solutions with centralized logging, metrics, tracing, and cost dashboards to enable rapid incident diagnosis.
- Lead cross-team incident analysis and resolution, documenting findings and corrective actions.
- Serve as the primary technical liaison for Network, Cloud, Security, Identity, and AI gateway teams, translating constraints into designs and requests into actionable tickets.
- Collaborate daily with product engineers to review infrastructure changes, enforce platform standards, and maintain up-to-date design documentation.
- Mentor and guide platform engineers as the team expands.

Required Qualifications

- 12 to 14 years of experience in software or infrastructure engineering, with at least 10 years of hands-on public cloud experience, including production ownership on both AWS and Azure.
- Proven track record designing and operating multi-tenant SaaS platforms and cross-region disaster recovery setups, with practical knowledge of failure modes.
- Extensive Terraform expertise, capable of interpreting plans and understanding resource changes.
- Deep technical knowledge of AWS services such as VPC, Transit Gateway, PrivateLink, ECS/EKS, RDS, EFS, ALB/NLB, IAM, KMS, Secrets Manager, CloudWatch, Route 53, Organizations, and SCPs.
- Strong Azure skills including Entra ID (enterprise apps, SAML, OIDC, conditional access), Key Vault with private endpoints, VNets, Private Link, Azure Policy, and hybrid connectivity.
- Networking proficiency covering cloud and on-premises routing, SD-WAN, security gateways like Zscaler, TLS, certificate lifecycle, and DNS split-horizon.
- Security expertise in zero trust principles, workload identity, secret rotation, container hardening, audit logging, and compliance evidence.
- Experience with container technologies (Docker, Fargate, Kubernetes), deployment strategies (blue/green, canary), CI/CD tools (GitHub Actions or equivalent), and vulnerability management including SBOMs.
- Ability to read and understand application code (TypeScript or Python) to identify infrastructure dependencies.
- Strong documentation skills, including decision records, runbooks, and incident reports with evidence.
- Commitment to testing in production-like environments and rehearsing failure scenarios.
- Clear communication and accountability in cross-team collaboration, backed by data and logs.
- Relevant certifications such as AWS Solutions Architect Professional or DevOps Engineer Professional, Microsoft Azure Solutions Architect Expert (AZ-305), or security credentials like AWS Security Specialty, AZ-500, or CCSP.

Preferred Qualifications and Benefits

- Experience hosting large language models (LLM) or AI agent workloads, including gateways, key brokering, cost metering per user, and sandbox isolation.
- Background in enterprise platform integrations such as ServiceNow, Salesforce, or SAP.
- Familiarity with FinOps practices including tenant cost allocation, rightsizing, and commitment planning.
- Exposure to regulated environments and customer audit processes.

Success in the First Six Months

- Deliver a documented target architecture for multi-tenant Codon on AWS and Azure, reviewed and agreed upon with Security and Network teams.
- Establish the production environment as code with deployment gates, logging, and cost reporting operational.
- Complete and document the first disaster recovery drill with agreed RPO/RTO targets.
- Resolve current security findings, demonstrate zero-downtime secret rotation, and prepare a comprehensive audit evidence package.
- Formalize working agreements with Network, Identity, and AI gateway teams, including named contacts and response expectations.

This role offers the opportunity to shape a cutting-edge cloud platform at scale, working with advanced AI integrations and enterprise-grade security and compliance standards.