AWS Cloud Architect – ETL, Terraform

Full Scale

AWS Cloud Architect responsible for cloud architecture and ETL/data pipelines in a production AWS platform for Full Scale. Hands-on role requiring extensive AWS and Terraform expertise.

Posted 7/29/2026contractRemote • 🇵🇭 PhilippinesMid-LevelSeniorWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in AWS architecture and cloud engineering, with a strong focus on multi-account design, security architecture, and data engineering. Proficient in Terraform/OpenTofu for infrastructure as code, alongside hands-on experience with ETL processes and data lake governance.

Highest-signal resume keywords

AWS Architecture DesignTerraform/OpenTofu ExpertiseETL/Data EngineeringSecurity Architecture KnowledgeData Lake Governance

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

AWS GluePythonSQLAurora ServerlessKMSIAMEventBridgeStep FunctionsData ModelingPerformance Tuning

Soft Skills

Technical DocumentationMentoring

Tools & Technologies

AWS OrganizationsControl TowerTransit GatewayLake FormationDatabricksFargateAPI GatewaySQSSNSCloudTrail

Industry Keywords

Multi-Account DesignData LakehouseBronze/Silver/Gold ArchitecturePCI ComplianceInfrastructure as Code

Tech Stack

Tools & technologies

AWSCloudDNSETLMySQLNode.jsPostgresPythonSparkSQLTerraform

About the role

Key responsibilities & impact

Own the multi-account AWS Organization design: OU structure, account vending, Service Control Policies, Control Tower guardrails, and IAM Identity Center for SSO.
Own network architecture — Transit Gateway hub-and-spoke, VPC design and segmentation, PrivateLink, DNS, and cross-account connectivity — designed for multi-region and multi-tenant growth.
Design the security architecture and keep it coherent as services multiply: IAM boundaries and least privilege, KMS key strategy, org-wide CloudTrail, GuardDuty/Security Hub/Inspector/Macie, and WAF/Shield at the edge.
Define reference architectures and standards for new services so the tenth service built looks like the first.
Author and maintain architecture documentation.
Lead the EKS adoption path: Fargate vs. managed node groups, IRSA, cluster networking, and which workloads belong in containers vs. staying serverless.
Own AWS Well-Architected reviews and drive remediation.
Own cloud cost architecture — tagging strategy, chargeback by workload, and commitment planning.
Own the Terraform/OpenTofu codebase end to end: module design, versioning, registry strategy, state management, and Terragrunt configuration across environments and accounts.
Enforce IaC quality through policy-as-code (OPA/Sentinel or equivalent), automated plan review, drift detection, and remediation.
Eliminate console-created resources — everything that exists should exist in code.
Mentor engineers on IaC patterns and review infrastructure changes.
Own the lakehouse architecture: S3 Bronze/Silver/Gold zones, partitioning and file-format strategy, Glue Data Catalog, Lake Formation governance, and Databricks integration.
Design, build, and maintain ETL and ELT pipelines ingesting from CRM/DMS systems, call data, payment systems, inventory feeds, and OEM sources — using AWS Glue, Lambda, Step Functions, EventBridge, and Databricks as appropriate.
Own data quality: validation at ingestion, schema evolution, reconciliation, late and duplicate record handling, and alerting when a feed goes quiet or goes wrong.
Design change-data-capture and incremental-load patterns; move off full reloads where they still exist.
Own the Aurora footprint (MySQL and PostgreSQL/pgvector), including schema design, performance tuning, and serverless scaling configuration.
Build the data lineage and cataloging practice so analysts and scientists can answer "where did this number come from" without asking a person.
Design pipelines with downstream ML consumption in mind — reproducible features, stable definitions, and backfill capability.
Define and enforce data retention, PII classification, and access control policy across the lake, with particular care around call recordings, payment data, and customer records.
Support PCI-relevant scoping and segmentation decisions on the payment path.

Requirements

What you’ll need

5+ years in cloud engineering with at least 4 years focused on AWS architecture.
Expert-level Terraform or OpenTofu (module authorship, state strategy, and multi-account patterns).
Demonstrated multi-account AWS design experience (Organizations, Control Tower, SCPs, Transit Gateway, IAM Identity Center).
Strong hands-on ETL/data engineering background using AWS Glue, Spark, Step Functions, and Python.
Experience designing data lakes or lakehouses, including Bronze/Silver/Gold architecture and governance using Lake Formation or similar.
Deep serverless experience with Lambda, API Gateway, EventBridge, SQS/SNS, and Aurora Serverless.
Strong SQL and relational data modeling skills, including performance tuning on Aurora or similar managed databases.
Strong security architecture knowledge, including IAM, KMS, network segmentation, and AWS security services.
Ability to write clear technical design documents that engineers can implement without additional clarification.

Benefits

Comp & perks

Fully remote – work from anywhere in the Philippines.
Senior architecture role with genuine decision-making authority over a production AWS platform.
Hands-on work with a mature, over-built cloud foundation — not a "build it from scratch" greenfield engagement.
Opportunity to shape data platform standards that will scale across multiple business units.
Small, senior, high-autonomy team with a documentation-first culture.
Collaborative engineering environment with strong Full Scale account support.
A team environment that values ownership, technical depth, and follow-through.