AWS Engineer

Job offer

Join the Cloud Platform team responsible for building and governing a centralized AWS Landing Zone and multi-account platform for a large banking group. The role focuses on designing, implementing, and enforcing cloud governance, security guardrails, networking foundations, and self-service account provisioning capabilities used by internal application teams.

Key Responsibilities

• Build and evolve AWS Landing Zone and AWS Organization structures across multiple business entities and Organizational Units (OUs).
• Design and implement multi-account AWS environments at enterprise scale.
• Develop and maintain Terraform modules and Infrastructure-as-Code automation.
• Build Account Vending and Account Factory capabilities for self-service account provisioning.
• Implement governance guardrails using SCPs, Control Tower controls and resource-based policies.
• Design IAM strategy including ABAC (Attribute-Based Assess Control), IAM Roles, Permission Sets, Permission Boundaries and IAM Identity Center.
• Create secure networking foundations, including Hub-Spoke architectures, Transit Gateway, VPC Endpoints, Direct Connect, and hybrid connectivity between on-premises datacenters and AWS.
• Build security baselines including CloudTrail, GuardDuty, logging, monitoring and service hardening.
• Define and enforce approved service catalog and cloud standards consumed by internal application teams.

Profile:

• Practical experience with AWS Organizations.
• Real-world experience designing OU structures and enterprise landing zones.
• Hands-on implementation of SCPs, Control Tower and governance controls.
• Experience operating large multi-account AWS environments.
• Expert Terraform knowledge, TF modules design and lifecycle management.
• GitHub and GitHub Actions automation.
• CI/CD implementation for platform services.
• Direct Connect.
• Cross-account networking.
• VPC endpoints.
• Hybrid DNS setup between on-premises datacenters and AWS.
• IAM, ABAC (Attribute-Based Access Controls) and enterprise access models.
• Permission Sets and Permission Boundaries.
• Encryption using BYOK/CMK.
• CloudTrail, GuardDuty and AWS security hardening.

At SoftwareOne Czech Republic, we believe work should fit around life - not the other way around. Here’s what you can look forward to when joining our team:

• Plenty of time off – 25 vacation days plus extra days for long service (up to 5 more)
• Flexibility that works – enjoy our hybrid setup, combining home office and time in our Prague space
• Fun & connection – annual team events, rooftop barbecues, and casual monthly breakfasts with your teammates
• Wellbeing support – a Multisport card, free weekly physiotherapy sessions in the office, and coffee & snacks always ready
• Commuting made easy – we cover your annual public transport pass
• Continuous learning – language classes and professional certifications aligned with your growth path