Cloud Engineer Marketing Data Platform

Capgemini • New York, NY

7d • $100,000 - $118,650

About The Position

The Cloud Engineer will design, operate, secure, and support a Google Cloud marketing data platform. The role owns the cloud foundation and landing zone, including resource hierarchy, identity and access, networking, security perimeters, encryption, and secrets management. It operates data and application services such as BigQuery, Cloud Storage, Pub/Sub, Dataflow, Datastream, Spanner, Cloud Run, and related delivery services, and provides the GCP foundation for Databricks.

The engineer provisions infrastructure with Terraform and manages CI/CD gates, policy checks, drift detection, Cloud Run releases, observability, disaster recovery, high availability, and FinOps. The position supports regulated-data compliance through controls, audit evidence, data scanning, and privacy safeguards, while delivering predictable latency and per-client isolation. The role requires client-facing consulting delivery, translating business requirements into technical specifications.

Requirements

• At least 5 years of cloud or platform engineering experience, including production Google Cloud experience.
• Deep Google Cloud expertise in IAM, VPC and Private Service Connect, VPC Service Controls, Cloud Run, BigQuery, Cloud Storage, Pub/Sub, and Cloud KMS.
• Experience with Terraform and CI/CD for cloud infrastructure.
• GCP security engineering experience, including organization policy, audit logging, secrets management, CMEK, and Sensitive Data Protection.
• Experience designing observability with Cloud Monitoring, Logging, alerting, and service-level objectives.
• Strong scripting skills in Python or Bash and working SQL knowledge for BigQuery administration.
• Experience in regulated industries; financial services is ideal, including familiarity with data residency, consent frameworks, GLBA, Fair Lending, and UDAAP.
• Ability to work in client-facing consulting delivery and translate business requirements into technical specifications.

Nice To Haves

• Google Cloud Professional certification, such as Cloud Architect, Cloud Security Engineer, or Cloud DevOps Engineer.
• Production experience operating Spanner, including Spanner Graph, Dataflow, and Datastream.
• Experience deploying Databricks on GCP, including workspaces, networking, and Unity Catalog storage setup.
• Experience with multi-tenant isolation design and per-tenant cost allocation.
• Experience building infrastructure for clean rooms and privacy-preserving data exchange.
• Familiarity with agent observability tooling such as LangSmith and LangGraph as a platform operator.

Responsibilities

• Design and operate Google Cloud resource hierarchy across organizations, folders, projects, environments, and tenants, including organization policies and labels.
• Manage IAM roles, service accounts, Workload Identity Federation, short-lived credentials, and least-privilege reviews.
• Design and own networking, including VPCs, Private Google Access, Private Service Connect, firewall policies, and DNS.
• Implement VPC Service Controls perimeters and the controlled egress gate between client and Capgemini environments.
• Manage encryption and secrets using Cloud KMS, customer-managed encryption keys, Secret Manager, and key rotation.
• Run Sensitive Data Protection scanning and de-identification at the landing boundary, and manage audit logging and retention for PII reads.
• Provide control evidence supporting GLBA, Fair Lending, UDAAP, and TCPA/CAN-SPAM alignment.
• Operate Cloud Storage lifecycle and retention, BigQuery administration and security, Pub/Sub, Dataflow, Datastream, and Spanner, including Spanner Graph.
• Operate the application tier, including Cloud Run services, Artifact Registry, Cloud Build, Cloud Scheduler, and Workflows, with runtime settings, scaling, and concurrency management.
• Provide the GCP foundation for Databricks, including projects, VPCs, service accounts, and GCS buckets.
• Provision infrastructure as code with Terraform, including CI/CD promotion gates, policy-as-code checks, and drift detection.
• Manage Cloud Run release processes, including revisions, traffic splitting, rollbacks, and image hygiene.
• Own Cloud Logging, Monitoring, and Trace, including service-level objectives, alerting, runbooks, and incident response.
• Design disaster recovery and high availability, including backups, regional and multi-region choices, and RPO/RTO targets.
• Own FinOps practices, including billing export to BigQuery, budgets and alerts, labels, committed-use and reservation decisions, and per-tenant cost allocation.
• Meet the serving contract required by the agentic layer, including predictable latency and per-client isolation.
• Translate business requirements into technical specifications in client-facing consulting delivery contexts.

Benefits

• Paid time off, including vacation of 12–25 days depending on employee grade, company-paid holidays, personal days, and sick leave.
• Medical, dental, and vision coverage, or provincial healthcare coordination in Canada.
• Retirement savings plans, such as 401(k) in the U.S. or RRSP in Canada.
• Life and disability insurance.
• Employee assistance programs.
• Other benefits as provided by local policy and eligibility.
• The role may be eligible for variable incentives, bonuses, or commissions, depending on the position and applicable laws.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level
• Education Level: No Education Listed