Principal Cloud Platform Architect - AWS

About the role

Loghic Hire is seeking a senior, hands-on architect to lead the containerization of a large-scale API estate for an enterprise financial services client and turn an approved AWS EKS reference architecture into a secure, repeatable production platform. This is an architect-who-builds role: you will write and review Terraform, Helm, Kustomize, Flux, and Istio policy, and stay close enough to the code, pipelines, and operational data to prove the platform works. Application images stay stateless and portable; the platform owns transport security, identity, routing, secrets, telemetry, admission policy, and rate limiting. You will operate at the intersection of architecture, hands-on engineering, and technical leadership — defining the target state, then building it, documenting it, and proving it in production. Expect to move fluidly between whiteboarding an ADR, reviewing a Terraform module, debugging an Istio waypoint, and coaching an SRE through a canary rollout.

Responsibilities

• EKS Platform Foundation & Golden Path Design: Design, build, and operate a repeatable, multi-AZ Amazon EKS Auto Mode foundation that serves as the golden path for all application teams. Implement and harden core cluster add-ons: VPC CNI, Karpenter (node provisioning and scaling), KEDA (event-driven autoscaling), CoreDNS, and metrics-server. Author reusable Terraform modules, Helm charts, and Kustomize overlays that encode platform standards and can be consumed self-service by application teams. Establish cluster lifecycle management: version upgrades, node rotation, add-on upgrades, and disaster recovery — with documented runbooks. Define multi-tenancy boundaries (namespaces, quotas, resource limits, RBAC) and enforce them through policy. Ensure the platform is fully documented and operable by SRE, including on-call runbooks, dashboards, and escalation paths. Define and publish golden path templates so new services can be onboarded in hours, not weeks.
• GitOps Delivery & Continuous Reconciliation: Make Flux the sole production deployment path — no ClickOps, no manual kubectl applies, no out-of-band changes. Implement continuous reconciliation across all clusters, with drift detection, alerting, and automated remediation. Integrate GitLab CI and Artifactory into the build-and-promote pipeline; enforce signed, digest-pinned images end to end. Build environment promotion workflows (dev → staging → prod) with policy gates and approval controls. Implement Flagger SLO-gated canary deployments, including metric analysis, automatic rollback, and progressive traffic shifting. Own the GitOps repository structure, branching model, and secrets-handling strategy (SOPS/Sealed Secrets/External Secrets). Drive image automation for dependency and base-image updates where appropriate.
• Service Mesh — Istio Ambient: Architect and operate Istio Ambient mode: istiod, istio-cni, ztunnel, and opt-in waypoints for L7 policy. Implement SPIFFE workload identity and strict mTLS across all east-west traffic. Author and enforce AuthorizationPolicy and default-deny NetworkPolicy for zero-trust segmentation. Define waypoint placement strategy — when to use L4 ztunnel vs. L7 waypoint — and document the trade-offs. Measure and report mesh latency and overhead; validate the ambient model meets performance budgets. Own mesh upgrade strategy, version skew policy, and troubleshooting playbooks. Provide mesh self-service patterns so application teams can declare their own policies safely.
• API Gateway & API Containerization: Deliver a single governed north-south ingress using Tyk Self-Managed, fully Operator-driven from Git. Implement authentication, authorization, rate limiting, quotas, routing, and API versioning at the gateway. Enable REST-to-gRPC transcoding so legacy REST consumers can reach modern gRPC services transparently. Lead the migration of existing APIs onto the platform — inventory, prioritization, cutover planning, and rollback strategy. Define API onboarding standards and self-service workflows for application teams. Own gateway observability, analytics (Tyk Pump), and policy lifecycle.
• Security, Compliance & Audit: Enforce Pod Security Standards (PSS) across all namespaces, with documented exceptions. Implement Kyverno admission policy as code — validation, mutation, and generation rules managed via Git. Configure EKS Pod Identity and least-privilege IAM roles for workloads and add-ons. Integrate AWS Secrets Manager / CSI driver and KMS for secrets and encryption at rest. Manage certificate lifecycle with cert-manager (issuance, rotation, revocation). Implement image signing and SBOM generation, with admission-time verification. Build a durable billing/audit capture path (Kinesis → Firehose → S3 Object Lock) with an approved, load-tested reliability contract. Produce threat models and participate in security reviews with the client's risk and compliance teams. Support PCI-scoped and SOC 2 control objectives across the platform.
• API Contracts, Reliability & Operations: Establish gRPC/Protobuf as the east-west standard, with buf breaking-change checks enforced in CI. Define SLOs and error budgets for platform services and the golden path; report on them regularly. Instrument the platform with OpenTelemetry for metrics, logs, and traces — built in, not bolted on. Build dashboards, alerts, and rollout analysis tooling for platform and application teams. Drive performance validation at tens of thousands of TPS, including load testing and capacity planning. Own incident response for the platform during build-out, including participation in the escalation rotation. Continuously improve reliability, cost efficiency, and operational ergonomics.
• Technical Leadership & Client