Reviewing and documenting the existing ASEA architecture, account structure, and guardrail configuration
Upgrading ASEA components to the latest supported version and validating core functionality (account provisioning, logging, networking, security services)
Designing the target LZA architecture including control plane migration, account alignment, network adjustments, and security services integration
Deploying and configuring the Landing Zone Accelerator in accordance with AWS best practices and GC guardrails
Configuring AWS Organizations, GuardDuty, Security Hub, AWS Config, centralized logging, and identity integrations
Validating automated account provisioning workflows and operational continuity post-migration
Remediating guardrail compliance findings and producing a post-migration validation report
Providing knowledge transfer to the client's cloud platform team

Hands-on experience with AWS Secure Environment Accelerator (ASEA) and/or Landing Zone Accelerator (LZA)
Demonstrated experience with AWS Organizations, Service Control Policies (SCPs), and multi-account governance
Proficiency with AWS security services: GuardDuty, Security Hub, AWS Config
Strong understanding of AWS networking in a landing zone context (Transit Gateway, VPC architecture, centralized logging)
Experience with infrastructure-as-code, particularly AWS CDK and/or CloudFormation
Familiarity with Government of Canada cloud guardrails and the CCCS Medium Cloud profile
Ability to obtain or current holder of Government of Canada security clearance (Reliability Status minimum)
AWS Certified Solutions Architect – Professional or AWS Certified DevOps Engineer – Professional (Nice to Have)
Prior experience delivering cloud engagements for federal government clients (Nice to Have)
Experience with CodePipeline-based LZA deployment pipelines (Nice to Have)
Secret clearance (Nice to Have)

AWS Cloud Consultant – Landing Zone Accelerator, Migration Contract

Key skills