Role #1: AWS Bedrock Cloud Infrastructure Architect - Infrastructure & Automation (L5) / Role #2: AWS Bedrock Cloud Infrastructure Architect - AI Security & Compliance (L5) ; G.C / U.S.C
12+Months
New York, NY (Hybrid & Must be Local – 2 Days/Week)
W2 Only (No C2C) :: : Only local candidates from New York (NY) and New Jersey (NJ) who can commute to the onsite location in New York, NY 10007, please apply. Candidates must be available to work onsite 2 days per week. No out-of-state candidates, please.
POSITION 1
Job Title: Cloud Infrastructure Architect – AWS & Bedrock Platform (L5)
Location: New York, NY 10007 (Hybrid, 2 days onsite/week)
Duration: 12+ months
Eligibility: Local candidates only (NY or NJ) able to commute to NYC 2 days/week
Role Overview:
Lead the architecture and delivery of secure, scalable AWS foundations and an enterprise GenAI platform built on Amazon Bedrock. You will design multi-account patterns, build reusable Terraform modules, integrate IaC into CI/CD, operationalize Bedrock model access and APIs, and implement robust observability and cost governance.
What You’ll Do:
- Design and implement AWS landing zones, account structures, VPC/networking, private connectivity to Bedrock, and baseline monitoring/logging
- Build reusable Terraform modules and templates; codify infrastructure standards and guardrails
- Automate infrastructure provisioning through enterprise CI/CD (e.g., Git-based workflows, approvals, policy checks)
- Stand up and manage Bedrock resources: model access, model invocation patterns, endpoints/APIs, inference throughput and routing where applicable
- Expose Bedrock APIs securely (e.g., ListModels, InvokeModel) with least-privilege IAM and service-to-service auth
- Implement observability (metrics, logs, traces, dashboards, alerts) and operational runbooks
- Partner with FinOps to enforce cost tagging, budgets, and usage visibility for GenAI workloads
- Collaborate with Security/Compliance to meet banking controls and audit requirements; produce architecture docs and diagrams
- Coach engineering teams on platform usage and best practices
Required Qualifications:
- 7+ years designing and operating AWS infrastructure at scale
- Hands-on expertise with IAM (roles, policies, instance profiles), AWS Organizations, account vending, and VPC design (subnets, routing, endpoints)
- Strong Terraform experience building modular, reusable IaC with versioning and testing
- CI/CD for IaC (pipelines, policy-as-code, automated plan/apply, drift detection)
- Practical experience with Amazon Bedrock: model access management, ListModels/InvokeModel APIs, model lifecycle and deployments
- Observability with CloudWatch (metrics, logs, alarms), CloudTrail, and log/trace analytics
- FinOps practices: tagging strategy, cost allocation, budgets/anomaly detection
- Experience in regulated financial services/banking environments
Nice to Have:
- Private connectivity patterns for Bedrock (VPC endpoints/PrivateLink where available), service controls, and data egress controls
- Exposure to AWS Control Tower, AWS Config, Security Hub, GuardDuty, KMS
- Experience integrating Bedrock with enterprise identity, service auth, and API gateways
- SRE practices (runbooks, SLOs, error budgets) and OpenTelemetry
- Python or bash for automation and tooling around IaC and operational tasks
Success Indicators (First 90 Days):
- Baseline AWS accounts, IAM, and VPC patterns in place and codified as Terraform modules
- CI/CD pipeline established for IaC with policy checks and approvals
- Secure API access for core Bedrock operations (ListModels, InvokeModel) enabled for target teams
- Initial observability dashboards and cost reporting live for GenAI workloads
Work Model:
- Hybrid in NYC (2 days onsite/week); no out-of-state applicants
POSITION 2
Job Title: AWS Bedrock Cloud Infrastructure Architect - AI Security & Compliance (L5)
Location: New York, NY 10007 (Hybrid, 2 days onsite/week)
Duration: 12+ months
Eligibility: Local candidates only (NY or NJ) able to commute to NYC 2 days/week
Role Overview:
Own the security architecture and compliance posture for enterprise GenAI workloads on AWS and Amazon Bedrock. You will define and implement security controls, IAM/authorization patterns, Bedrock Guardrails, Service Control Policies, and threat modeling for high-assurance banking use cases.
What You’ll Do:
- Design and enforce security baselines for AWS multi-account GenAI platforms (Organizations, SCPs, guardrails, detective and preventive controls)
- Implement access management and authorization for Bedrock usage (least privilege, conditional access, service-to-service auth)
- Create and manage Bedrock Guardrails to mitigate safety, privacy, and policy risks; define redaction and content filters aligned to enterprise standards
- Configure and manage Bedrock Inference Profiles (where applicable) to segment access, throughput, and governance for model usage
- Conduct threat modeling for GenAI solutions (data flows, prompt/response risks, jailbreak and data leakage vectors) and drive remediation
- Integrate logging, monitoring, and audit trails for GenAI activities (CloudWatch, CloudTrail, Config, Security Hub)
- Partner with compliance, risk, and model governance teams to align with banking policies and regulatory expectations
- Embed FinOps and data classification/tagging to control spend and protect sensitive data
- Deliver security architecture documents, standards, and reusable policy-as-code patterns
Required Qualifications:
- 7+ years in cloud security architecture with deep AWS experience
- Expertise with IAM, AWS Organizations, and SCPs; proven track record implementing enterprise-scale security controls
- Hands-on experience implementing security controls for GenAI/LLM platforms, including Bedrock Guardrails and model access governance
- Knowledge of Bedrock APIs and operational patterns; experience creating/using Bedrock Inference Profiles
- Strong background in threat modeling and risk assessment for AI systems and data flows
- Observability and security monitoring (CloudWatch, CloudTrail, Security Hub, GuardDuty)
- FinOps awareness for cost governance and chargeback in regulated environments
- Banking or other highly regulated domain experience
Nice to Have:
- Familiarity with data protection and privacy controls (KMS, key policies, tokenization/redaction strategies)
- Experience with Control Tower, Config conformance packs, detective controls, and policy-as-code (e.g., OPA)
- Knowledge of industry frameworks relevant to financial services (e.g., NIST CSF/800-53, ISO 27001, SOC 2, GLBA considerations)
- Exposure to model governance practices for GenAI (usage policies, human-in-the-loop, auditability)
- Scripting/automation to codify controls and checks in CI/CD
Success Indicators (First 90 Days):
- SCPs and IAM guardrails defined and applied to GenAI accounts
- Bedrock Guardrails configured for priority use cases with monitoring and exception workflow
- Threat models completed for initial workloads with remediation plans in motion
- Centralized logging and audit trails validated for GenAI activities
