Cloud Governance Engineer

This is a governance role where you will define the rules our cloud estate runs by, making those rules enforceable in code, and proving they are working. You will write standards that other engineering teams have to follow and explain technical risks to Finance, Security, and Product leadership. The estate is roughly 70% Google Cloud, with AWS and Azure in scope as secondary platforms.

• Define, document, and maintain cloud governance policies and standards across GCP, AWS, and Azure, and turn them into enforceable technical controls using GCP Organization Policy, AWS SCPs and Config, and Azure Policy
• Own the exception and waiver process end to end: intake, risk assessment, time-bound approval, expiry, and follow-up
• Partner with Security to enforce Identity and Access Management and network security standards across the organization, and review access models for least privilege
• Build and maintain dashboards that track governance metrics: security posture, key and credential rotation, policy violations, configuration drift, and time to remediation
• Own resource labeling and tagging standards and enforce them, so that cost, ownership, and environment can be attributed reliably
• Drive cost governance: spend visibility and showback, anomaly detection, commitment and discount coverage reviews, and surfacing waste to the teams that own it
• Collaborate with IT, Finance, Security, DevOps, Cloud Architects, and Product Engineering to keep governance controls consistent across all environments, and translate technical risk into language those stakeholders can act on
• Work with stakeholders to define service level objectives, key performance indicators, and metrics for operational efficiency
• Support the review of new third-party cloud services before they enter the estate

• 4+ years working in public cloud environments, including at least 2 years hands-on with GCP
• Hands-on experience implementing preventative guardrails in at least one hyperscaler (GCP Organization Policy, AWS SCPs or Config, Azure Policy)
• Experience authoring a cloud policy or standard that other teams were required to follow, not only implementing one written elsewhere
• Experience running or contributing to an exception or waiver process for cloud controls
• Working knowledge of cloud IAM, network security, encryption, and key and secret management
• Infrastructure-as-Code with Terraform, and comfort extending it to policy-as-code
• Python for automation, enforcement, and reporting
• Demonstrated ability to explain a technical risk to a non-technical audience and drive a decision
• Candidates who reside within Porto, Maia, Matosinhos, Gondomar, Valongo e Vila Nova de Gaia would be required to work in-office 3 days a week

• Google Cloud Professional Cloud Security Engineer or Professional Cloud Architect certification
• Policy-as-code tooling: OPA, Conftest, Sentinel
• Cloud cost tooling: GCP billing exports and BigQuery, AWS Cost Explorer, or a third-party platform such as Cloudability or Apptio
• Familiarity with the control frameworks our platform is audited against (SOC 2, HIPAA, GDPR)
• Kubernetes governance and policy enforcement
• Okta integration, Microsoft Active Directory Federation Services
• Bachelor's degree in Computer Science, Engineering, or another relevant technical field
• Result oriented, self-starter

• Five9 Equity Programs
• Bonus Scheme
• 10% Flex Benefit
• Meal Allowance
• Medical Insurance
• Life Insurance
• 25 day Annual Leave + Public Holidays

Resumo organizado por IA a partir do anúncio original. Confirma os detalhes no site da empresa.