Lead Cloud Platform Engineer - AWS Control Tower & Service Enablement at Lincoln Financial Group

Job description

Alternate Locations: Radnor, PA (Pennsylvania); Charlotte, NC (North Carolina); Fort Wayne, IN (Indiana); Greensboro, NC (North Carolina) Work Arrangement: Hybrid : Employee will work 3 days a week in a Lincoln office Relocation assistance: is not available for this opportunity. Requisition #: 76724 The Role at a Glance We are seeking a highly motivated Lead Cloud Platform Engineer to join our Cloud Engineering team, with a primary focus on AWS Control Tower, enterprise landing zone engineering, and the secure enablement of AWS services. This is an enterprise cloud platform engineering role, not an application development or application-focused DevOps position. The engineer will build, govern, automate, and operate the shared AWS foundation used by multiple application teams, including landing zones, account provisioning, platform controls, and approved cloud and AI services, including Amazon Bedrock AgentCore. The successful candidate will possess hands-on ownership experience with a shared enterprise AWS platform, deep practical AWS Control Tower knowledge and implementation experience, a demonstrated ability to take AWS services from evaluation through production enablement, and working knowledge of Amazon Bedrock AgentCore. Strong software development and automation skills applied to reusable platform capabilities, experience with AI and machine learning technologies, and excellent written and verbal communication skills are essential. This position does not include direct people management responsibilities but requires strong technical influence and collaboration across stakeholders. What you'll be doing • Lead the design, implementation, automation, and ongoing operation of AWS Control Tower and enterprise landing zones, including multi-account structures, organizational units, account provisioning and enrollment, baseline configurations, landing zone upgrades, and drift remediation. • Implement and maintain AWS Control Tower controls and account governance in partnership with security teams, integrating AWS Organizations, service control policies (SCPs), IAM Identity Center, AWS Config, and centralized logging. • Drive end-to-end AWS service enablement: assess use cases and dependencies, coordinate architecture and security reviews, define approved configurations and access patterns, build reusable Infrastructure as Code, validate controls, and deliver production-ready services with documented support ownership. • Develop and maintain cloud automation using Python and Infrastructure as Code to standardize account provisioning, landing zone configurations, service deployment, and ongoing platform lifecycle management. • Build and enhance GitLab CI/CD pipelines for shared platform infrastructure, account baselines, and reusable AWS service enablement patterns. • Evaluate, enable, and support AI and machine learning capabilities, with particular emphasis on enabling Amazon Bedrock AgentCore as a governed enterprise platform capability. Develop shared deployment patterns, access controls, observability, and support boundaries for Runtime, Gateway, Identity, Memory, and Observability in partnership with AI, application, architecture, and security teams. The focus is enabling application teams to build and operate agents, not primarily developing application-specific agents. • Partner with architects, developers, security teams, and operations teams to deliver shared cloud platform capabilities and approved service patterns that application teams can consume. • Implement cloud best practices related to security, scalability, resiliency, and operational excellence. • Troubleshoot and resolve complex issues in the shared AWS platform, including account provisioning, governance controls, identity integrations, and service enablement; collaborate with application teams to distinguish platform issues from application-owned issues. • Drive continuous improvement initiatives across cloud engineering processes and tooling. Technical Skills Cloud & Platform • AWS / AWS Control Tower • Landing Zone • AWS Organizations, organizational units, SCPs, IAM Identity Center, AWS Config, & AWS CloudTrail • EC2 • S3 • VPC • IAM • Lambda • API Gateway • EKS • ECS/Fargate • RDS • CloudWatch • Splunk • SNOW Development & Automation • Python • GitLab • CI/CD Pipelines • AWS CDK • CloudFormation • REST APIs • Reusable service enablement modules, account baseline automation, & automated configuration validation AI & Machine Learning • Amazon Bedrock AgentCore: Runtime, Gateway, Identity, Memory, and Observability • SageMaker • Generative AI • Prompt Engineering • AI/ML Workflows • Agent-Based Solutions Enterprise Tools • ServiceNow • Jira • Confluence What we’re looking for Must-haves: • 5-10 years of experience in Cloud Engineering, DevOps, Platform Engineering, or related roles, including demonstrated hands-on ownership and engineering of a shared, enterprise-wide AWS platform supporting multiple accounts and application teams. Experience must include platform-level configuration, governance, automation, lifecycle management, and operational support. Experience limited to developing, deploying, or supporting applications within an existing AWS environment does not meet this requirement. • Deep hands-on experience implementing, administering, and troubleshooting AWS Control Tower in an enterprise multi-account environment; practical experience with landing zone lifecycle management, Account Factory, account enrollment, organizational units, controls, and drift remediation is required. • Demonstrated experience enabling AWS services for enterprise use, including technical evaluation, architecture and security review, automated deployment patterns, testing, documentation, and operational readiness—not solely deploying services for individual applications. • Working knowledge of Amazon Bedrock AgentCore, including the purpose and integration considerations of Runtime, Gateway, Identity, Memory, and Observability, and an understanding of platform responsibilities versus application-owned agent logic. • Strong Python development and automation skills. • Experience building and maintaining GitLab CI/CD pipelines. • Experience with AI and Machine Learning technologies and platforms. • Strong understanding of AWS architecture, cloud networking, security, and multi-account governance, including AWS Organizations, SCPs, IAM Identity Center, least-privilege access, AWS Config, and AWS CloudTrail. • Experience with Infrastructure as Code tools such as CloudFormation, or AWS CDK. • Experience with containerization technologies such as Docker and Kubernetes/EKS. • Experience with Agile delivery methodologies. Nice-to-haves: • Hands-on experience implementing or piloting Amazon Bedrock AgentCore, including secure tool/API connectivity, identity integration, deployment automation, and agent monitoring and troubleshooting. • Experience with Amazon Bedrock, Amazon SageMaker, or Generative AI technologies. • Experience designing and supporting enterprise cloud platforms, including AWS Control Tower adoption, landing zone migrations or upgrades, and automated account customization. • Familiarity with DevSecOps practices. • Experience with observability and monitoring tools such as CloudWatch, Datadog, Splunk, or Dynatrace. • Experience with ServiceNow, Jira, and Confluence. • Strong knowledge of Microsoft 365 products and collaboration platforms. • AWS certifications such as: AWS Solutions Architect Associate or Professional, AWS DevOps Engineer Professional, or AWS Machine Learning Specialty Application Deadline Applications for this position will be accepted through 2/1/27, subject to close earlier. What’s it like to work here? At Lincoln Financial, we love what we do. We make meaningful contributions each and every day to empower our customers to take charge of their lives. Working alongside dedicated and talented colleagues, we build fulfilling careers and stronger communities through a company that values our unique perspectives, insights and contributions and invests in programs that empower each of us to take charge of our own future. What’s in it for you: • Clearly defined career tracks and job levels, along with associated behaviors for each of Lincoln's core values and leadership attributes • Leadership development and virtual training opportunities • PTO/parental leave • Competitive 401K and employee benefits • Free financial counseling, health coaching and employee assistance program • Tuition assistance program • Work arrangements that work for you • Effective productivity/technology tools and training The pay range for this position is $135,375 - $216,600 with anticipated pay for new hires between the minimum and midpoint of the range and could vary above and below the listed range as permitted by applicable law. Pay is based on non-discriminatory factors including but not limited to work experience, education, location, licensure requirements, proficiency and qualifications required for the role. The base pay is just one component of Lincoln’s total rewards package for employees. In addition, the role may be eligible for the Annual Incentive Program, which is discretionary and based on the performance of the company, business unit and individual. Other rewards may include long-term incentives, sales incentives and Lincoln’s standard benefits package. About The Company Lincoln Financial (NYSE: LNC) helps people to confidently plan for their version of a successful future. We focus on identifying a clear path to financial security, with products including annuities, life insurance, group protection, and retirement plan services. With our 120-year track record of expertise and integrity, millions of customers trust our solutions and service to help put their goals in reach. Lincoln Financial Distributors, a broker-dealer, is the wholesale distribution organization of Lincoln Financial. Lincoln Financial is the marketing name for Lincoln Financial Corporation and its affiliates including The Lincoln National Life Insurance Company, Fort Wayne, IN, and Lincoln Life & Annuity Company of New York, Syracuse, NY. Lincoln Financial affiliates, their distributors, and their respective employees, representatives and/or insurance agents do not provide tax, accounting or legal advice. Lincoln is committed to creating an inclusive environment and is proud to be an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, gender, gender identity or expression, sexual orientation, national origin, genetics, disability, age, or veteran status. Follow us on Facebook , X , LinkedIn , Instagram , and YouTube . For the latest company news, visit our newsroom . Be Aware of Fraudulent Recruiting Activities If you are interested in a career at Lincoln, we encourage you to review our current openings and apply on our website. Lincoln values the privacy and security of every applicant and urges all applicants to diligently protect their sensitive personal information from scams targeting job seekers. These scams can take many forms including fake employment applications, bogus interviews and falsified offer letters. Lincoln will not ask applicants to provide their social security numbers, date of birth, bank account information or other sensitive information in job applications. Additionally, our recruiters do not communicate with applicants through free e-mail accounts (Gmail, Yahoo, Hotmail) or conduct interviews utilizing video chat rooms. We will never ask applicants to provide payment during the hiring process or extend an offer without conducting a phone, live video or in-person interview. Please contact Lincoln's fraud team at fraudhotline@lfg.com if you encounter a recruiter or see a job opportunity that seems suspicious. Additional Information This position may be subject to Lincoln’s Political Contribution Policy. An offer of employment may be contingent upon disclosing to Lincoln the details of certain political contributions. Lincoln may decline to extend an offer or terminate employment for this role if it determines political contributions made could have an adverse impact on Lincoln’s current or future business interests, misrepresentations were made, or for failure to fully disclose applicable political contributions and or fundraising activities. Any unsolicited resumes or candidate profiles submitted through our web site or to personal e-mail accounts of employees of Lincoln Financial are considered property of Lincoln Financial and are not subject to payment of agency fees. Lincoln Financial ("Lincoln" or "the Company") is an Equal Opportunity employer and, as such, is committed in policy and practice to recruit, hire, compensate, train and promote, in all job classifications, without regard to race, color, religion, sex, age, national origin or disability. Opportunities throughout Lincoln are available to employees and applicants are evaluated on the basis of job qualifications. If you are a person with a disability that impedes your ability to express your interest for a position through our online application process, or require TTY/TDD assistance, contact us by calling (866) 922-6543. This Employer Participates in E-Verify. See the E-Verify notices. Este Empleador Participa en E-Verify. Ver el E-Verify avisos.

Requirements

Must-haves

Alternate Locations: Radnor, PA (Pennsylvania); Charlotte, NC (North Carolina); Fort Wayne, IN (Indiana); Greensboro, NC (North Carolina)
Hybrid : Employee will work 3 days a week in a Lincoln office
Relocation assistance: is not available for this opportunity.
Requisition #: 76724
The Role at a Glance
What you'll be doing
Develop and maintain cloud automation using Python and Infrastructure as Code to standardize account provisioning, landing zone configurations, service deployment, and ongoing platform lifecycle management.
Build and enhance GitLab CI/CD pipelines for shared platform infrastructure, account baselines, and reusable AWS service enablement patterns.
Partner with architects, developers, security teams, and operations teams to deliver shared cloud platform capabilities and approved service patterns that application teams can consume.
Implement cloud best practices related to security, scalability, resiliency, and operational excellence.
Drive continuous improvement initiatives across cloud engineering processes and tooling.
Technical Skills
Cloud & Platform

Nice-to-haves

Hands-on experience implementing or piloting Amazon Bedrock AgentCore, including secure tool/API connectivity, identity integration, deployment automation, and agent monitoring and troubleshooting.
Experience with Amazon Bedrock, Amazon SageMaker, or Generative AI technologies.
Experience designing and supporting enterprise cloud platforms, including AWS Control Tower adoption, landing zone migrations or upgrades, and automated account customization.
Familiarity with DevSecOps practices.
Experience with observability and monitoring tools such as CloudWatch, Datadog, Splunk, or Dynatrace.
Experience with ServiceNow, Jira, and Confluence.
Strong knowledge of Microsoft 365 products and collaboration platforms.
AWS certifications such as: AWS Solutions Architect Associate or Professional, AWS DevOps Engineer Professional, or AWS Machine Learning Specialty
Application Deadline
Applications for this position will be accepted through 2/1/27, subject to close earlier.
What’s it like to work here?

Application prep

Use the role’s language and application details while tailoring your materials.

Keywords to mirror

awsaimachine learningpythonci/cdapirestmljiradockerkubernetesagile

Platform: successfactors
Effort: medium

Benefits

Benefits detected in the listing.

Vision

401k

Pto

Parental Leave