Cloud Infrastructure Engineer

Stanford University is hiring a Cloud Infrastructure Engineer for the SLAC Cloud Services team. The role designs, automates, secures, and operates AWS and Google Cloud infrastructure, integrating public cloud services with on-premises systems to support scientific research and business operations.

Responsibilities:

• Design, deploy, operate, and continuously improve infrastructure and shared services across a multi-cloud platform
• Build and maintain secure AWS multi-account and GCP multi-project environments using AWS Organizations, AWS Control Tower or Landing Zone Accelerator, and the Google Cloud resource hierarchy
• Develop reusable infrastructure-as-code modules and deployment patterns using Terraform, AWS CloudFormation, Google Cloud infrastructure tools, or equivalent technologies
• Automate provisioning, configuration, policy enforcement, compliance validation, patching, and routine operational tasks using Python, PowerShell, Bash, or similar tools
• Build and maintain CI/CD pipelines for cloud infrastructure and platform services
• Collaborate with the Networking team to design and support connectivity between SLAC data centers, AWS, and GCP, including VPNs, dedicated connections, transit architectures, routing, DNS, firewalls, proxies, load balancers, and network segmentation
• Work with Cybersecurity to translate security and compliance requirements into cloud guardrails, technical controls, monitoring, policies, and automated compliance checks
• Partner with Identity and Access Management teams to implement federation, single sign-on, role-based access control, service accounts, workload identities, privileged-access controls, and least-privilege access
• Integrate cloud platforms with on-premises compute, storage, directory, backup, monitoring, logging, and operational systems
• Configure and operate security capabilities including encryption, key management, secrets management, audit logging, vulnerability management, configuration monitoring, and policy enforcement
• Develop centralized logging, monitoring, alerting, and observability using Amazon CloudWatch, AWS CloudTrail, Google Cloud Logging and Monitoring, Splunk, and other enterprise platforms
• Support cloud-native and containerized workloads using technologies such as Docker, Amazon ECS, Amazon EKS, Google Kubernetes Engine, and serverless computing
• Establish backup, recovery, resilience, and disaster-recovery patterns appropriate for administrative, operational, and scientific workloads
• Monitor cloud consumption and implement cost-management practices, including budgets, tagging and labeling standards, rightsizing, optimization, and cost-allocation reporting
• Troubleshoot complex technical issues spanning cloud infrastructure, networking, identity, security, applications, and on-premises systems
• Participate in architecture and security reviews, incident response, root-cause analysis, change management, and service-improvement activities
• Create and maintain architecture diagrams, engineering standards, implementation guides, operational runbooks, knowledge articles, and support procedures
• Evaluate new AWS and GCP services based on security, reliability, interoperability, operational readiness, supportability, cost, and mission value
• Engage with researchers, application owners, and business teams to understand their requirements and translate them into sustainable cloud solutions
• Provide technical guidance, knowledge transfer, and mentoring to other members of the Cloud Services team
• Collaborate with cloud providers, implementation partners, and external subject-matter experts while ensuring that technical knowledge and operational ownership remain within SLAC
• Participate in an on-call or after-hours support rotation when required for critical cloud services
• Design, develop, install, and maintain operating systems, utilities, and applications software on computing systems
• Resolve system emergencies with significant impact on the integrity of user data and systems
• Design, configure, implement, and maintain system security strategies, policies, and procedures
• Establish software/hardware standards and systems policies and procedures
• Engage in long-term strategic planning with regard to systems development and integration
• Conceptualize and implement systems within broad technical or structural frameworks
• Perform capacity planning for system configuration, software services, network services, load distribution, and service interrelationships among computer systems
• Act as technical expert and mentor for local computer system administration
• Act as project leader on large-scale computing projects in which strong technical, directional, and personal leadership is necessary; assign and oversee the work of other system administrators as needed
• Manage vendor relationships and cost-effective hardware and software maintenance agreements with vendors

Requirements:

• Hands-on experience designing, deploying, or operating production infrastructure in AWS, GCP, or another major public cloud platform
• Experience with cloud networking, compute, storage, identity and access management, logging, monitoring, and security services
• Experience using infrastructure-as-code technologies such as Terraform or AWS CloudFormation
• Experience with Git, version control, code review, and pull-request-based engineering practices
• Experience automating infrastructure or operational processes using Python, PowerShell, Bash, or a comparable scripting language
• Working knowledge of TCP/IP, routing, DNS, firewalls, load balancers, VPNs, certificates, proxies, and network-security principles
• Working knowledge of Linux or Windows server administration
• Understanding of cloud security principles, including least privilege, encryption, secrets management, audit logging, network segmentation, and secure configuration
• Experience troubleshooting technical issues across infrastructure, applications, networking, identity, and security
• The ability to communicate technical concepts, risks, dependencies, and recommendations clearly to technical and nontechnical stakeholders
• Demonstrated ability to document solutions, share knowledge, and collaborate across technical and organizational boundaries
• A collaborative approach to working with Cybersecurity, Networking, Platform Engineering, IAM, application teams, researchers, and service owners
• An infrastructure-as-code mindset and a preference for reusable, automated, and supportable services over manually configured resources
• The ability to balance security, reliability, performance, maintainability, usability, flexibility, and cost
• Ownership of assignments from initial requirements and design through implementation, documentation, operational transition, support, and continuous improvement
• Sound judgment when working with sensitive information, privileged access, regulated environments, and production systems
• The ability to work effectively in an evolving cloud environment where standards, tools, and operating practices are actively being developed
• A willingness to investigate unfamiliar technologies and collaborate with vendors or subject-matter experts when additional expertise is required
• The ability to recognize when a solution should be standardized for broad use and when scientific or experimental workloads require additional flexibility
• A commitment to sharing knowledge, mentoring colleagues, and reducing single points of technical dependency
• The ability to resolve technical disagreements through evidence, testing, clear communication, and consideration of organizational requirements
• Bachelor's degree and eight years of relevant experience, or a combination of education and relevant experience
• Experience with complex, multi-system platforms and vendors
• Experience coordinating multi-system and computing environments in independent computing facilities
• Experience developing/implementing a business continuation and disaster recovery plan
• Proven ability to develop appropriate plans to meet computing needs
• Advanced ability to program in multiple programming languages in multiple operating systems
• Proven ability to lead and work on large/complex system deployment projects in a team environment
• Advanced knowledge of security trends and best practices
• Production engineering experience with both AWS and GCP
• Experience designing or operating enterprise-scale AWS landing zones or GCP organization and project structures
• Experience with AWS Organizations, Control Tower, Landing Zone Accelerator, IAM Identity Center, Transit Gateway, VPC, Security Hub, GuardDuty, AWS Config, CloudTrail, and CloudWatch
• Experience with Google Cloud IAM, Organization Policy Service, Shared VPC, Cloud Interconnect, Cloud Router, Cloud Logging, Cloud Monitoring, Security Command Center, and Cloud Asset Inventory
• Experience integrating public cloud platforms with Microsoft Entra ID, Active Directory, LDAP, SAML, OAuth, OIDC, or SCIM
• Experience with hybrid or multicloud network architecture, including centralized inspection, shared services, dedicated connectivity, and hub-and-spoke designs
• Experience with Kubernetes, container platforms, serverless architectures, platform engineering, or developer self-service capabilities
• Experience with policy-as-code and compliance automation using AWS Config rules, Google Cloud organization policies, Open Policy Agent, HashiCorp Sentinel, or similar technologies
• Experience integrating cloud logs and security events with Splunk or another SIEM platform
• Experience supporting scientific computing, research data, high-performance computing, analytics, artificial intelligence, or machine-learning workloads
• Familiarity with NIST 800-53, FedRAMP, Department of Energy requirements, or comparable regulated-environment security frameworks
• Experience implementing cloud financial management or FinOps practices
• Relevant AWS, Google Cloud, Kubernetes, Terraform, networking, or security certifications