Cloud Infrastructure Engineer
Stanford University · United States · remote
Position Overview
The Cloud Infrastructure Engineer is a member of the SLAC Cloud Services team responsible for designing, implementing, automating, securing, and operating infrastructure across Amazon Web Services (AWS) and Google Cloud Platform (GCP).
This position helps develop the cloud platforms, shared services, technical standards, automation, and operational practices that support SLAC’s scientific research and business operations. The engineer will work across SLAC’s hybrid environment, integrating public cloud services with on-premises infrastructure, enterprise identity, networking, cybersecurity, monitoring, and support capabilities.
The position collaborates closely with Cybersecurity, Networking, Identity and Access Management, Platform Engineering, application teams, data teams, researchers, and external service providers. Success requires strong hands-on cloud engineering experience, an infrastructure-as-code mindset, sound technical judgment, and the ability to translate requirements into secure, reliable, scalable, and supportable solutions.
Your specific responsibilities will include:
- Design, deploy, operate, and continuously improve infrastructure and shared services across a multi-cloud platform.
- Build and maintain secure AWS multi-account and GCP multi-project environments using AWS Organizations, AWS Control Tower or Landing Zone Accelerator, and the Google Cloud resource hierarchy.
- Develop reusable infrastructure-as-code modules and deployment patterns using Terraform, AWS CloudFormation, Google Cloud infrastructure tools, or equivalent technologies.
- Automate provisioning, configuration, policy enforcement, compliance validation, patching, and routine operational tasks using Python, PowerShell, Bash, or similar tools.
- Build and maintain CI/CD pipelines for cloud infrastructure and platform services.
- Collaborate with the Networking team to design and support connectivity between SLAC data centers, AWS, and GCP, including VPNs, dedicated connections, transit architectures, routing, DNS, firewalls, proxies, load balancers, and network segmentation.
- Work with Cybersecurity to translate security and compliance requirements into cloud guardrails, technical controls, monitoring, policies, and automated compliance checks.
- Partner with Identity and Access Management teams to implement federation, single sign-on, role-based access control, service accounts, workload identities, privileged-access controls, and least-privilege access.
- Integrate cloud platforms with on-premises compute, storage, directory, backup, monitoring, logging, and operational systems.
- Configure and operate security capabilities including encryption, key management, secrets management, audit logging, vulnerability management, configuration monitoring, and policy enforcement.
- Develop centralized logging, monitoring, alerting, and observability using Amazon CloudWatch, AWS CloudTrail, Google Cloud Logging and Monitoring, Splunk, and other enterprise platforms.
- Support cloud-native and containerized workloads using technologies such as Docker, Amazon ECS, Amazon EKS, Google Kubernetes Engine, and serverless computing.
- Establish backup, recovery, resilience, and disaster-recovery patterns appropriate for administrative, operational, and scientific workloads.
- Monitor cloud consumption and implement cost-management practices, including budgets, tagging and labeling standards, rightsizing, optimization, and cost-allocation reporting.
- Troubleshoot complex technical issues spanning cloud infrastructure, networking, identity, security, applications, and on-premises systems.
- Participate in architecture and security reviews, incident response, root-cause analysis, change management, and service-improvement activities.
- Create and maintain architecture diagrams, engineering standards, implementation guides, operational runbooks, knowledge articles, and support procedures.
- Evaluate new AWS and GCP services based on security, reliability, interoperability, operational readiness, supportability, cost, and mission value.
- Engage with researchers, application owners, and business teams to understand their requirements and translate them into sustainable cloud solutions.
- Provide technical guidance, knowledge transfer, and mentoring to other members of the Cloud Services team.
- Collaborate with cloud providers, implementation partners, and external subject-matter experts while ensuring that technical knowledge and operational ownership remain within SLAC.
- Participate in an on-call or after-hours support rotation when required for critical cloud services.
To be successful in this position, you will bring:
- Hands-on experience designing, deploying, or operating production infrastructure in AWS, GCP, or another major public cloud platform.
- Experience with cloud networking, compute, storage, identity and access management, logging, monitoring, and security services.
- Experience using infrastructure-as-code technologies such as Terraform or AWS CloudFormation.
- Experience with Git, version control, code review, and pull-request-based engineering practices.
- Experience automating infrastructure or operational processes using Python, PowerShell, Bash, or a comparable scripting language.
- Working knowledge of TCP/IP, routing, DNS, firewalls, load balancers, VPNs, certificates, proxies, and network-security principles.
- Working knowledge of Linux or Windows server administration.
- Understanding of cloud security principles, including least privilege, encryption, secrets management, audit logging, network segmentation, and secure configuration.
- Experience troubleshooting technical issues across infrastructure, applications, networking, identity, and security.
- The ability to communicate technical concepts, risks, dependencies, and recommendations clearly to technical and nontechnical stakeholders.
- Demonstrated ability to document solutions, share knowledge, and collaborate across technical and organizational boundaries.
The candidate best positioned to succeed with the SLAC team will also demonstrate:
- A collaborative approach to working with Cybersecurity, Networking, Platform Engineering, IAM, application teams, researchers, and service owners.
- An infrastructure-as-code mindset and a preference for reusable, automated, and supportable services over manually configured resources.
- The ability to balance security, reliability, performance, maintainability, usability, flexibility, and cost.
- Ownership of assignments from initial requirements and design through implementation, documentation, operational transition, support, and continuous improvement.
- Sound judgment when working with sensitive information, privileged access, regulated environments, and production systems.
- The ability to work effectively in an evolving cloud environment where standards, tools, and operating practices are actively being developed.
- A willingness to investigate unfamiliar technologies and collaborate with vendors or subject-matter experts when additional expertise is required.
- The ability to recognize when a solution should be standardized for broad use and when scientific or experimental workloads require additional flexibility.
- A commitment to sharing knowledge, mentoring colleagues, and reducing single points of technical dependency.
- The ability to resolve technical disagreements through evidence, testing, clear communication, and consideration of organizational requirements.
Preferred qualifications
- Production engineering experience with both AWS and GCP.
- Experience designing or operating enterprise-scale AWS landing zones or GCP organization and project structures.
- Experience with AWS Organizations, Control Tower, Landing Zone Accelerator, IAM Identity Center, Transit Gateway, VPC, Security Hub, GuardDuty, AWS Config, CloudTrail, and CloudWatch.
- Experience with Google Cloud IAM, Organization Policy Service, Shared