Infrastructure Cloud Engineer

Creative Chaos is looking for a hands-on Cloud Engineer to design, automate, secure, and manage cloud workloads across both Azure and AWS environments. This role involves ownership of core platform components such as infrastructure as code using Terraform, Kubernetes clusters (AKS/EKS), secure networking, CI/CD enablement, observability, and FinOps practices. The successful candidate will collaborate closely with DevOps, software, and web engineering teams to deliver cloud platforms that are resilient, scalable, and compliant. The ideal candidate brings strong expertise in multi-cloud architecture, Kubernetes operations, identity and access management, security guardrails, automation, and platform reliability, with a pragmatic, automation-first approach to cloud engineering.

Key Responsibilities

Platform Engineering:
- Design and implement landing zones using hub-and-spoke models and policy guardrails across Azure and AWS.
- Develop and maintain Terraform modules, workspaces, remote state management, and automated environment provisioning from development to production.
- Operate and secure AKS and EKS clusters, including managing node pools, autoscaling, ingress controllers, image scanning/signing, and zero-downtime upgrades.
- Build and improve CI/CD pipelines using GitHub Actions, Azure DevOps, or Jenkins to support build, test, scan, deploy, and gated promotion workflows.
- Enable application platforms such as API Management/API Gateway, Azure Functions/AWS Lambda, and messaging services like Service Bus, SNS/SQS, and EventBridge.
- Manage observability tools including Azure Monitor, Log Analytics, Application Insights, CloudWatch, X-Ray, and OpenTelemetry, ensuring actionable alerts, runbooks, SLIs/SLOs, and on-call participation.
- Lead FinOps initiatives focusing on tagging standards, cost allocation, rightsizing, reserved instances/savings plans, egress optimization, and Well-Architected reviews.

Security, Governance & Operations:
- Integrate logs and telemetry data with SIEM solutions.
- Implement and maintain security guardrails using Azure Policy, AWS Config, Defender for Cloud, Security Hub, GuardDuty, and WAF policies.
- Enforce least-privilege access models across Entra ID (including PIM and managed identities) and AWS IAM/Identity Center, including workload identity federation for CI/CD pipelines.
- Manage change control and audit processes through infrastructure-as-code workflows, runbooks, and architectural decision records.
- Maintain patch and version hygiene for Kubernetes, node OS/AMIs, container images, and managed services, including automated drift detection.
- Lead incident investigations, perform root cause analysis, and implement preventative controls such as policies, guardrails, and pipeline checks.
- Provide architectural guidance on security, reliability, networking, and cost during design reviews.

Required Qualifications
- Bachelor’s degree in IT, Computer Science, or a related field.
- Minimum of 5 years of hands-on experience working with both Azure and AWS in production environments.
- Deep expertise in Terraform, including modules, workspaces, state management, and policy as code.
- Strong operational experience with Kubernetes (AKS/EKS), Helm, ingress controllers, and container registries (ACR/ECR).
- Solid networking fundamentals including VNet/VPC, routing, VPNs, Private Link/Endpoints, ExpressRoute/Direct Connect, load balancers, WAF, and DNS.
- Proficient in identity and access management using Entra ID and AWS IAM, including SSO/OIDC and secrets management (Key Vault/KMS).
- Experience implementing CI/CD pipelines with GitHub Actions, Azure DevOps, or Jenkins, including security gates and artifact repositories.
- Observability and Site Reliability Engineering (SRE) experience covering metrics, logs, tracing, alerting, incident response, and post-mortems.
- Strong scripting skills in PowerShell and Bash, with OS-level expertise across Linux and Windows.
- Familiarity with disaster recovery patterns, high availability architectures, and RTO/RPO planning.

Preferred Qualifications
- Experience with M365 Conditional Access policies, including global policies, break-glass, and step-up authentication.
- Knowledge of AWS landing zone tooling such as Control Tower, IAM Identity Center, and account vending/guardrails.
- Ability to read and maintain CloudFormation or Bicep templates alongside Terraform.
- Web hosting experience involving CDN/WAF (Front Door/CloudFront), TLS/PKI, caching, and performance tuning.
- Understanding of data fundamentals including S3/Blob lifecycle management, RDS/Aurora/SQL MI/Postgres, and caching services like Redis/ElastiCache/Azure Cache.
- Expertise in Kubernetes and supply-chain security, including admission controls, image signing, and software bill of materials (SBOM).

Certifications (Preferred)
- Azure certifications such as AZ-104, AZ-305, AZ-500; AZ-700 and AZ-400 are advantageous.
- AWS certifications including Solutions Architect – Associate; Professional-level certifications in Solutions Architect or DevOps, with Security or Advanced Networking as a plus.
- Kubernetes and HashiCorp certifications like Certified Kubernetes Administrator (CKA), Terraform Associate; Certified Kubernetes Security Specialist (CKS) is a bonus.
- FinOps Certified Practitioner is an added advantage.

This role offers the opportunity to work on cutting-edge cloud technologies within a collaborative and innovative environment, driving cloud platform excellence and operational efficiency.