Cloud Infrastructure Engineer

Position Overview

The Cloud Infrastructure Engineer is a member of the SLAC Cloud Services team responsible for designing, implementing, automating, securing, and operating infrastructure across Amazon Web Services (AWS) and Google Cloud Platform (GCP).

This position helps develop the cloud platforms, shared services, technical standards, automation, and operational practices that support SLAC’s scientific research and business operations. The engineer will work across SLAC’s hybrid environment, integrating public cloud services with on-premises infrastructure, enterprise identity, networking, cybersecurity, monitoring, and support capabilities.

The position collaborates closely with Cybersecurity, Networking, Identity and Access Management, Platform Engineering, application teams, data teams, researchers, and external service providers. Success requires strong hands-on cloud engineering experience, an infrastructure-as-code mindset, sound technical judgment, and the ability to translate requirements into secure, reliable, scalable, and supportable solutions.

Your specific responsibilities will include:

• Design, deploy, operate, and continuously improve infrastructure and shared services across a multi-cloud platform.
• Build and maintain secure AWS multi-account and GCP multi-project environments using AWS Organizations, AWS Control Tower or Landing Zone Accelerator, and the Google Cloud resource hierarchy.
• Develop reusable infrastructure-as-code modules and deployment patterns using Terraform, AWS CloudFormation, Google Cloud infrastructure tools, or equivalent technologies.
• Automate provisioning, configuration, policy enforcement, compliance validation, patching, and routine operational tasks using Python, PowerShell, Bash, or similar tools.
• Build and maintain CI/CD pipelines for cloud infrastructure and platform services.
• Collaborate with the Networking team to design and support connectivity between SLAC data centers, AWS, and GCP, including VPNs, dedicated connections, transit architectures, routing, DNS, firewalls, proxies, load balancers, and network segmentation.
• Work with Cybersecurity to translate security and compliance requirements into cloud guardrails, technical controls, monitoring, policies, and automated compliance checks.
• Partner with Identity and Access Management teams to implement federation, single sign-on, role-based access control, service accounts, workload identities, privileged-access controls, and least-privilege access.
• Integrate cloud platforms with on-premises compute, storage, directory, backup, monitoring, logging, and operational systems.
• Configure and operate security capabilities including encryption, key management, secrets management, audit logging, vulnerability management, configuration monitoring, and policy enforcement.
• Develop centralized logging, monitoring, alerting, and observability using Amazon CloudWatch, AWS CloudTrail, Google Cloud Logging and Monitoring, Splunk, and other enterprise platforms.
• Support cloud-native and containerized workloads using technologies such as Docker, Amazon ECS, Amazon EKS, Google Kubernetes Engine, and serverless computing.
• Establish backup, recovery, resilience, and disaster-recovery patterns appropriate for administrative, operational, and scientific workloads.
• Monitor cloud consumption and implement cost-management practices, including budgets, tagging and labeling standards, rightsizing, optimization, and cost-allocation reporting.
• Troubleshoot complex technical issues spanning cloud infrastructure, networking, identity, security, applications, and on-premises systems.
• Participate in architecture and security reviews, incident response, root-cause analysis, change management, and service-improvement activities.
• Create and maintain architecture diagrams, engineering standards, implementation guides, operational runbooks, knowledge articles, and support procedures.
• Evaluate new AWS and GCP services based on security, reliability, interoperability, operational readiness, supportability, cost, and mission value.
• Engage with researchers, application owners, and business teams to understand their requirements and translate them into sustainable cloud solutions.
• Provide technical guidance, knowledge transfer, and mentoring to other members of the Cloud Services team.
• Collaborate with cloud providers, implementation partners, and external subject-matter experts while ensuring that technical knowledge and operational ownership remain within SLAC.
• Participate in an on-call or after-hours support rotation when required for critical cloud services.

 

To be successful in this position, you will bring:

• Hands-on experience designing, deploying, or operating production infrastructure in AWS, GCP, or another major public cloud platform.
• Experience with cloud networking, compute, storage, identity and access management, logging, monitoring, and security services.
• Experience using infrastructure-as-code technologies such as Terraform or AWS CloudFormation.
• Experience with Git, version control, code review, and pull-request-based engineering practices.
• Experience automating infrastructure or operational processes using Python, PowerShell, Bash, or a comparable scripting language.
• Working knowledge of TCP/IP, routing, DNS, firewalls, load balancers, VPNs, certificates, proxies, and network-security principles.
• Working knowledge of Linux or Windows server administration.
• Understanding of cloud security principles, including least privilege, encryption, secrets management, audit logging, network segmentation, and secure configuration.
• Experience troubleshooting technical issues across infrastructure, applications, networking, identity, and security.
• The ability to communicate technical concepts, risks, dependencies, and recommendations clearly to technical and nontechnical stakeholders.

• Demonstrated ability to document solutions, share knowledge, and collaborate across technical and organizational boundaries.

   

The candidate best positioned to succeed with the SLAC team will also demonstrate:

• A collaborative approach to working with Cybersecurity, Networking, Platform Engineering, IAM, application teams, researchers, and service owners.
• An infrastructure-as-code mindset and a preference for reusable, automated, and supportable services over manually configured resources.
• The ability to balance security, reliability, performance, maintainability, usability, flexibility, and cost.
• Ownership of assignments from initial requirements and design through implementation, documentation, operational transition, support, and continuous improvement.
• Sound judgment when working with sensitive information, privileged access, regulated environments, and production systems.
• The ability to work effectively in an evolving cloud environment where standards, tools, and operating practices are actively being developed.
• A willingness to investigate unfamiliar technologies and collaborate with vendors or subject-matter experts when additional expertise is required.
• The ability to recognize when a solution should be standardized for broad use and when scientific or experimental workloads require additional flexibility.
• A commitment to sharing knowledge, mentoring colleagues, and reducing single points of technical dependency.

• The ability to resolve technical disagreements through evidence, testing, clear communication, and consideration of organizational requirements.

   

Preferred qualifications

• Production engineering experience with both AWS and GCP.
• Experience designing or operating enterprise-scale AWS landing zones or GCP organization and project structures.
• Experience with AWS Organizations, Control Tower, Landing Zone Accelerator, IAM Identity Center, Transit Gateway, VPC, Security Hub, GuardDuty, AWS Config, CloudTrail, and CloudWatch.
• Experience with Google Cloud IAM, Organization Policy Service, Shared VPC, Cloud Interconnect, Cloud Router, Cloud Logging, Cloud Monitoring, Security Command Center, and Cloud Asset Inventory.
• Experience integrating public cloud platforms with Microsoft Entra ID, Active Directory, LDAP, SAML, OAuth, OIDC, or SCIM.
• Experience with hybrid or multicloud network architecture, including centralized inspection, shared services, dedicated connectivity, and hub-and-spoke designs.
• Experience with Kubernetes, container platforms, serverless architectures, platform engineering, or developer self-service capabilities.
• Experience with policy-as-code and compliance automation using AWS Config rules, Google Cloud organization policies, Open Policy Agent, HashiCorp Sentinel, or similar technologies.
• Experience integrating cloud logs and security events with Splunk or another SIEM platform.
• Experience supporting scientific computing, research data, high-performance computing, analytics, artificial intelligence, or machine-learning workloads.
• Familiarity with NIST 800-53, FedRAMP, Department of Energy requirements, or comparable regulated-environment security frameworks.
• Experience implementing cloud financial management or FinOps practices.

• Relevant AWS, Google Cloud, Kubernetes, Terraform, networking, or security certifications.

   

SLAC employee competencies

• Effective decision-making: Uses sound judgment, available evidence, and organizational priorities to make timely and well-informed decisions.
• Problem solving: Identifies root causes, evaluates alternatives, and implements practical and sustainable solutions.
• Collaboration: Builds productive working relationships and contributes effectively across teams and organizational boundaries.
• Communication: Communicates technical information clearly and adapts messaging to technical, scientific, operational, and leadership audiences.
• Customer focus: Understands stakeholder needs and delivers reliable, secure, and supportable services that advance SLAC’s mission.
• Adaptability: Responds constructively to changing technologies, priorities, requirements, and operational conditions.
• Accountability: Takes ownership of commitments, communicates risks and dependencies, and follows work through completion.
• Continuous improvement: Identifies opportunities to improve automation, reliability, security, efficiency, documentation, and service delivery.

Core Duties:

• Design, develop, install, and maintain operating systems, utilities, and applications software on computing systems.

• Resolve system emergencies with significant impact on the integrity of user data and systems.

• Design, configure, implement, and maintain system security strategies, policies, and procedures.

• Establish software/hardware standards and systems policies and procedures.

• Engage in long-term strategic planning with regard to systems development and integration.

• Conceptualize and implement systems within broad technical or structural frameworks.

• Perform capacity planning for system configuration, software services, network services, load distribution, and service interrelationships among computer systems.

• Act as technical expert and mentor for local computer system administration.

• Act as project leader on large-scale computing projects in which strong technical, directional, and personal leadership is necessary; assign and oversee the work of other system administrators as needed.

• Manage vendor relationships and cost-effective hardware and software maintenance agreements with vendors.

Minimum Education and Experience:

Bachelor's degree and eight years of relevant experience, or a combination of education and relevant experience.

Knowledge, Skills and Abilities:

• Experience with complex, multi-system platforms and vendors.

• Experience coordinating multi-system and computing environments in independent computing facilities.

• Experience developing/implementing a business continuation and disaster recovery plan.

• Proven ability to develop appropriate plans to meet computing needs.

• Advanced ability to program in multiple programming languages in multiple operating systems.

• Proven ability to lead and work on large/complex system deployment projects in a team environment.

• Advanced knowledge of security trends and best practices.