AWS Cloud Platform SME

Key Responsibilities

Landing Zone and Account Management

. Design, build, and manage the enterprise AWS landing zone using AWS Control Tower, AWS Organizations, and Service Control Policies.

. Own account vending, organizational unit structure, and account lifecycle management (Account Factory / AFT).

. Manage centralized identity and access using AWS IAM Identity Center, federation with Azure AD/Okta, and permission set governance.

Platform Networking

. Design and manage hub-and-spoke network architecture using Transit Gateway, VPC, Direct Connect, Site-to-Site VPN, and PrivateLink.

. Manage hybrid DNS with Route 53 Resolver, IP address management (VPC IPAM), and network segmentation.

. Oversee centralized ingress/egress, AWS Network Firewall, WAF, and Shield.

Shared Services and Platform Operations

. Manage shared platform services including logging, monitoring, backup, patching, and directory services.

. Oversee AMI lifecycle and golden image pipelines using EC2 Image Builder.

. Manage patching, inventory, and automation with AWS Systems Manager (Patch Manager, State Manager, Session Manager).

. Implement centralized backup and retention policies using AWS Backup.

. Manage platform capacity, service quotas, and limits across accounts.

Platform Governance, Security, and Compliance

. Define and enforce platform guardrails using SCPs, AWS Config conformance packs, and Control Tower controls.

. Manage centralized security services: GuardDuty, Security Hub, CloudTrail (organization trail), Inspector, Macie, and IAM Access Analyzer.

. Manage encryption and key governance with AWS KMS.

. Ensure compliance with MAS TRM, PDPA, ISO 27001, and CIS AWS Foundations Benchmark.

Platform Services Catalog and Enablement

. Build and maintain a standardized service catalog using AWS Service Catalog or Terraform modules.

. Define platform standards, reference architectures, and onboarding patterns for application teams.

. Act as the technical authority and escalation point for AWS platform issues.

Platform Resilience and Cost Governance

. Design multi-region resilience and DR patterns for platform services.

. Oversee platform-level cost governance using Cost Explorer, AWS Budgets, Compute Optimizer, Savings Plans, and tagging policies.

. Track AWS service updates and evaluate their impact on the platform.

Technical Skills Required

. 12-15 years in IT infrastructure, with at least 8 years of hands-on AWS platform experience.

. Expert knowledge of AWS Control Tower, Organizations, SCPs, and multi-account architecture.

. Deep expertise in AWS networking (Transit Gateway, Direct Connect, Route 53 Resolver, PrivateLink).

. Strong experience with AWS Systems Manager, EC2 Image Builder, AWS Backup, and centralized logging.

. Strong knowledge of AWS security and governance services.

. Proficiency in Terraform or CloudFormation for platform automation.

. Scripting skills in Python or Bash.

Good to Have

. AWS Certified Solutions Architect - Professional, Advanced Networking - Specialty, or Security - Specialty.

. HashiCorp Terraform Associate certification.

. Experience in government environments in Singapore.