Job description

Job Description: Google Cloud Architect (Hands-On) Type: Full Time Seniority: Senior/Staff (Hands-on) Team: Platform/Cloud Engineering Our client is looking for a hands-on Google Cloud Architect to design and build a scalable, secure, and resilient GCP foundation. You'll own the core landing zone architecture (network, org structure, IAM, guardrails), lead reference implementations, and partner with security, platform, data, and app teams to evolve our cloud operating model. What You'll Do: Design & Build the GCP Foundation Define organization structure (folders, projects), naming/labeling, resource hierarchy, billing and quotas. Implement VPC networks, Private Service Connect, Cloud NAT, and secure ingress/egress patterns. Establish network segmentation, hierarchical firewall policies, perimeter controls (VPC SC), and DNS strategy. Identity & Access (IAM) at Scale: Build least-privilege IAM with custom roles, service accounts, workload identity federation, and group-based access. Implement policy-as-code and Organization Policies for consistent guardrails. Fault-Tolerant, Well-Architected Designs Architect multi-zone and multi-region patterns for GKE/Compute/Serverless; DR/RTO/RPO strategies; data durability and backup policies. Create resilience playbooks (circuit breakers, retries, blue/green & canary, zonal/region failover). Observability & Operations: Implement a logging, metrics, and tracing stack with Cloud Logging/Monitoring, uptime checks, SLOs/SLIs, alerting, dashboards. Define golden signals, distributed tracing standards, error budgets, and operational runbooks. Project Design/Build/Management: Lead project templates and blueprints (Terraform/Deployment Manager), CI/CD integration, and environment promotion workflows. Run architecture reviews, threat modeling, and cost/perf trade-off analyses. Enablement & Governance: Stand up CICD + IaC pipelines, artifact management, and baseline security scanning. Partner with SecOps to embed CSPM and continuous compliance (CIS, NIST, SOC 2). Mentor engineers; publish reference architectures and how-to guides. What Good Looks Like (6 Month Outcomes): A production-ready GCP landing zone with repeatable project factory patterns. Shared services and network perimeters in place; clear service-to-service communication patterns. Observability baselines (SLOs, golden dashboards, alert routing) across key services. Documented DR patterns with tested failover runbooks. 70-90% of new infra provisioned via Terraform Measurable improvements in security posture, cost visibility, and time-to-environment. Required Qualifications: 7+ years designing and building on public cloud (3+ on Google Cloud Platform). Deep expertise in Google Network, Compute, AI, Storage and other services. Strong IAM design at enterprise scale: org policies, custom roles, SA lifecycle, workload identity, secrets management. Proven project design/build/management: templating (Terraform), CI/CD integration, environment strategy (dev/test/stage/prod). Observability: Cloud Logging/Monitoring, tracing (OpenTelemetry), SLO/SLI design, alerting strategy. Fault tolerance & reliability engineering: multi-zone/region designs, DR strategies, backup/restore, chaos/failover testing. Hands-on with Terraform, Git, CI/CD (Cloud Build/GitHub Actions/Jenkins), and one scripting language (Python/Go/Bash). Strong communicator who can lead design docs, ADRs, and cross-team design reviews. Nice-to-Have: Certifications: Google Professional Cloud Architect, Professional Cloud Network Engineer, Professional DevOps Engineer. Experience with GKE (autoscaling, node pools, HPA/VPA), Anthos, or serverless (Cloud Run/Functions). Security tools: Security Command Center, DLP, KMS/HSM. Data-plane familiarity: Pub/Sub, BigQuery, Dataflow, Spanner/Cloud SQL high availability patterns. FinOps: budget governance, labels/tags, cost allocation and optimization. Tech Stack You'll Touch: Core GCP: Resource Manager, IAM, VPC/Shared VPC, Cloud DNS, Cloud NAT, Cloud Load Balancing, PSC, Interconnect/VPN, Org Policies, VPC SC Compute/Platform: GKE, Cloud Run, GCE, MIGs, Autoscaling, Cloud Build, Artifact Registry Data/Resilience: Cloud Storage, Cloud SQL, Spanner, Pub/Sub, Backup/DR tools Observability: Cloud Logging/Monitoring, Trace, Error Reporting, OpenTelemetry IaC & Tooling: Terraform, Git, Policy-as-Code (OPA/Conftest), Secret Manager Salary/Rate: $85-$100/HR (depends on experience level). This is a contract position with candidates expected to work 40 hours/ week.

Requirements

Must-haves

Google Cloud Architect (Hands-On) Type: Full Time Seniority: Senior/Staff (Hands-on) Team: Platform/Cloud Engineering
Design & Build the GCP Foundation
Define organization structure (folders, projects), naming/labeling, resource hierarchy, billing and quotas.
Implement VPC networks, Private Service Connect, Cloud NAT, and secure ingress/egress patterns.
Establish network segmentation, hierarchical firewall policies, perimeter controls (VPC SC), and DNS strategy.
Build least-privilege IAM with custom roles, service accounts, workload identity federation, and group-based access.
Implement policy-as-code and Organization Policies for consistent guardrails.
Fault-Tolerant, Well-Architected Designs
Architect multi-zone and multi-region patterns for GKE/Compute/Serverless; DR/RTO/RPO strategies; data durability and backup policies.
Create resilience playbooks (circuit breakers, retries, blue/green & canary, zonal/region failover).
Implement a logging, metrics, and tracing stack with Cloud Logging/Monitoring, uptime checks, SLOs/SLIs, alerting, dashboards.
Define golden signals, distributed tracing standards, error budgets, and operational runbooks.
Lead project templates and blueprints (Terraform/Deployment Manager), CI/CD integration, and environment promotion workflows.
Run architecture reviews, threat modeling, and cost/perf trade-off analyses.
Stand up CICD + IaC pipelines, artifact management, and baseline security scanning.
Partner with SecOps to embed CSPM and continuous compliance (CIS, NIST, SOC 2).
Mentor engineers; publish reference architectures and how-to guides.
A production-ready GCP landing zone with repeatable project factory patterns.
Shared services and network perimeters in place; clear service-to-service communication patterns.

Nice-to-haves

Certifications: Google Professional Cloud Architect, Professional Cloud Network Engineer, Professional DevOps Engineer.
Experience with GKE (autoscaling, node pools, HPA/VPA), Anthos, or serverless (Cloud Run/Functions).
Security tools: Security Command Center, DLP, KMS/HSM.
Data-plane familiarity: Pub/Sub, BigQuery, Dataflow, Spanner/Cloud SQL high availability patterns.
FinOps: budget governance, labels/tags, cost allocation and optimization.

Application prep

Use the role’s language and application details while tailoring your materials.

Keywords to mirror

gcpci/cdaipythongosql

Platform: careers-page
Effort: medium

Benefits

Benefits detected in the listing.

Vision