Architect I - Cloud Infrastructure Services

Role Description
Cloud Architect, Codon Platform (AWS and Azure)
Location: UST Hyderabad
Type: Full time, in-house
About The Role
Codon is UST's governed developer platform: a web chat and a browser terminal that put Claude to work on ServiceNow and other enterprise platforms, with every write
audited, every secret brokered, and every destination controlled at the network edge. It runs today on AWS (ECS Fargate, RDS PostgreSQL, EFS, internal ALB with blue/green
deployments, a Squid egress tier) with Azure for identity (Entra) and Key Vault, reached over a transit gateway, SD-WAN and Zscaler.
We are hiring the person who owns this architecture end to end and takes it from a single-tenant dev and pilot footprint to a secure, multi-tenant, resilient product. You
will be the technical authority for infrastructure, the counterpart to our network, security, identity and AI gateway teams, and the hands that write the Terraform.
What you will do
Architecture and roadmap
Own the target architecture for Codon across AWS and Azure: landing zone, account and subscription structure, network, identity, data, secrets, observability.
Design and deliver multi-tenancy: tenant isolation at the account, network, data and identity layers; per-tenant cost attribution; tenant onboarding as code.
Design and deliver disaster recovery and business continuity: RPO and RTO targets per tier, cross-region strategy, backup and restore drills, runbooks that are
rehearsed, not written once.
Define the environment model (dev, test, pilot, production) and the promotion path between them, including the deployment gate that holds a release until its checks
Security
Raise the platform to a documented security posture: least-privilege IAM, workload identity, secret rotation with zero downtime (we already rotate database and gateway
keys), private endpoints, egress allow-listing, encryption and key management (KMS and Key Vault).
Run threat modelling for the platform's trust boundaries, including an AI agent with a shell inside a container, and close the findings.
Prepare the platform for internal security review and for customer audits (SOC 2 style evidence, logging and retention, access reviews).
Build and operate
Write and review the Terraform (modules, environment roots, policy as code). Everything is code; nothing is clicked in a console.
Own the CI/CD and release tooling with the product team: image builds, SBOMs, the deployer, evidence capture.
Set up observability that answers questions in minutes: central logging, metrics, tracing, ing, cost dashboards.
Lead incident analysis across teams. Recent examples from our own log: a rotated database password that silently broke new connections, an egress path that drops for
hours on a shared security gateway, a load balancer whose private addresses changed under a fixed route.
Work with others
Be the single technical contact for UST's Network, Cloud, Security, Identity and AI gateway teams; turn their constraints into designs and their requests into tickets
with evidence.
Pair with the product engineers daily. Review their infrastructure changes, teach them the platform's rules, and keep the design records current.
Guide one or two platform engineers as the team grows.
What you bring
Experience
12 to 14 years in software or infrastructure engineering, of which at least 10 years hands-on in public cloud, with production ownership on both AWS and Azure. Depth on
one, real delivery on the other.
You have designed and operated at least one multi-tenant SaaS platform and at least one cross-region DR setup, and you can describe what broke in each.
You have written Terraform for years, not months. You can read a plan and tell what will be replaced and why.
Technical
AWS: VPC design, Transit Gateway, PrivateLink, ECS or EKS, RDS, EFS, ALB and NLB, IAM, KMS, Secrets Manager, CloudWatch, Route 53, Organizations and SCPs.
Azure: Entra ID (enterprise apps, SAML and OIDC, conditional access), Key Vault with private endpoints, VNets and Private Link, Azure Policy, hybrid connectivity.
Networking: routing across cloud and on-premises, SD-WAN and security gateways such as Zscaler, TLS and certificate lifecycle, DNS split-horizon.
Security: zero trust principles, workload identity, secret rotation, container hardening, audit logging, compliance evidence.
Containers and delivery: Docker, Fargate or Kubernetes, blue/green and canary deployments, GitHub Actions or equivalent, SBOM and vulnerability management.
Comfortable reading application code (TypeScript or Python) well enough to find where an infrastructure assumption lives.
Ways of working
You write things down: decision records, runbooks, incident reports with evidence. You prefer a diagram and a table to a meeting.
You test in production-like conditions and rehearse failures before they happen.
You are direct with other teams about what is theirs and what is ours, with the logs to show it.
Certifications (any two, or equivalent demonstrated experience)
AWS Solutions Architect Professional or DevOps Engineer Professional
Microsoft Azure Solutions Architect Expert (AZ-305)
A security credential such as AWS Security Specialty, AZ-500 or CCSP
Nice to have
Experience hosting LLM or agent workloads: gateways, key brokering, cost metering per user, isolation of agent sandboxes.
Enterprise platform background: ServiceNow, Salesforce or SAP integration patterns.
FinOps practice: cost allocation by tenant, rightsizing, commitment planning.
Exposure to regulated environments and customer audits.
First six months, what success looks like
A written target architecture for multi-tenant Codon on AWS and Azure, reviewed with Security and Network, with a sequenced plan.
Production environment stood up as code with the deployment gate, logging, ing and cost reporting in place.
A DR design with targets agreed, and the first restore drill completed and documented.
The current security findings closed, secret rotation proven without downtime, and an audit evidence pack that a reviewer can read.
Standing working agreements with the Network, Identity and AI gateway teams, with named contacts and response expectations.
Skills
AWS, Azure Policy, AWS Transit Gateway, AWS Fargate

Work arrangement
No