AWS Cloud Engineer from Beijing

Project Overview The client is building a Container-as-a-Service (CaaS) platform from scratch on AWS, fully managed through Infrastructure as Code (Terraform). The platform falls under PCI DSS compliance scope, making security, auditability, and controlled change management mandatory requirements throughout the project lifecycle. They are seeking a hands-on Senior Cloud Platform Engineer to drive the end-to-end delivery, from: * The first AWS account setup * The first line of Terraform code * Through to a complete GitHub CI + ArgoCD continuous delivery pipeline ⸻ Key Responsibilities 1. Design and Build AWS Landing Zone from Scratch * Implement a multi-account AWS architecture using AWS Organizations * Design networking architecture including: * VPC * Subnets * NAT Gateway * Transit Gateway * Establish shared services and security foundations: * GuardDuty * Security Hub * AWS Config * CloudTrail ⸻ 2. Design Container Platform (CaaS) Architecture Core platform services: * Amazon EKS * Amazon ECR * Service Mesh * Observability stack: * CloudWatch * Prometheus / Grafana * OpenTelemetry Supporting data services: * S3 * SQS * RDS * ElastiCache ⸻ 3. Own Infrastructure as Code (Terraform) Responsibilities include: * Terraform project structure design * Reusable module development * Terraform automated testing * Infrastructure drift detection * End-to-end traceable deployment process from: * terraform plan * deployment approval * production rollout ⸻ 4. Build CI/CD Pipeline Continuous Integration (CI) Using GitHub Actions: * Build automation * Testing * Security scanning * OIDC-based passwordless deployment to AWS Continuous Delivery (CD) Using ArgoCD: * GitOps deployment model * Environment promotion: * Dev * Staging * Production * Automated rollback ⸻ 5. Establish Security Baseline Implement: * Least-privilege IAM * Secrets management: * AWS Secrets Manager * Parameter Store * Vault * Encryption in transit and at rest * WAF protection * Network segmentation * CI/CD vulnerability scanning ⸻ 6. Ensure Platform Auditability * Centralized logging * Immutable audit trails * Change records mapped directly to pull requests (PRs) * Audit-ready documentation and evidence collection ⸻ 7. Work with Security & Compliance Teams Participate in: * PCI DSS scope definition * Security control implementation * Audit preparation activities ⸻ Required Qualifications AWS Experience * Minimum 3 years hands-on AWS experience * At least 1 year building a production environment from scratch (not merely maintaining existing environments) Terraform * Strong Terraform expertise * Ability to design reusable modules * CloudFormation experience is acceptable if willing to adopt Terraform AWS Services Deep hands-on experience with: * VPC * IAM * ECS / EKS * ECR * S3 * KMS * CloudFront * ALB / NLB * CloudTrail * AWS Config CI/CD Strong experience with: * GitHub Actions * OIDC Federation * Composite Actions * Matrix Builds * Self-hosted Runners * ArgoCD * GitOps deployment methodologies Containers / Kubernetes Required: * Kubernetes * Docker image creation and hardening * Container registry security * Strong Linux and networking fundamentals Security Mindset Knowledge of: * Least privilege principles * Threat modeling * Secret management hygiene * Software supply chain security * SBOM * Dependency scanning Engineering Practices * Small PRs * CI quality gates * Proper module boundaries * Avoidance of manual changes that create infrastructure drift ⸻ Expected Deliverables Terraform Repository * Fully operational IaC repository * Reusable modules * Automated testing framework CI/CD Platform * GitHub Actions CI * ArgoCD CD * Environment promotion and rollback capability Architecture Documentation * Landing Zone architecture diagrams * Network topology diagrams * Security architecture documentation Security Baseline Documentation * IAM policies * Encryption configurations * WAF rules * Network segmentation documentation Audit Readiness Materials * PCI DSS control mapping * Change management procedures * Log archival strategy Knowledge Transfer * Runbooks * Team training * Handover documentation