Lead Cloud Platform Engineer - AWS Control Tower & Service Enablement

Lincoln Financial•Radnor, PA

32d•$135,375 - $216,600•Hybrid

About The Position

Lincoln Financial is seeking a Lead Cloud Platform Engineer for its Cloud Engineering team. The role focuses on AWS Control Tower, enterprise landing zone engineering, and secure enablement of AWS services. It is an enterprise cloud platform engineering position, responsible for building, governing, automating, and operating a shared AWS foundation for multiple application teams—not application development or application-focused DevOps. Platform capabilities include landing zones, account provisioning, governance controls, and approved cloud and AI services, including Amazon Bedrock AgentCore. The engineer will own and operate AWS Control Tower and enterprise landing zones, establish governance and reusable service enablement patterns, and develop automation with Python and Infrastructure as Code. The role also involves GitLab CI/CD, assessing and enabling AWS and AI/ML services for production use, and providing shared deployment patterns and operational boundaries for Amazon Bedrock AgentCore. The engineer will collaborate with architecture, security, application, and operations teams, troubleshoot shared-platform issues, and continuously improve cloud engineering processes and tooling. The position has no direct people-management responsibilities, but requires technical influence and cross-functional collaboration. The position is hybrid, with work in a Lincoln office three days per week. Locations listed are Radnor, Pennsylvania; Charlotte and Greensboro, North Carolina; and Fort Wayne, Indiana. Relocation assistance is not available. The posted pay range is $135,375–$216,600, with new-hire pay anticipated between the minimum and midpoint; the role may also be eligible for the discretionary Annual Incentive Program and other rewards.

Requirements

5–10 years of experience in Cloud Engineering, DevOps, Platform Engineering, or related roles, including hands-on ownership and engineering of a shared enterprise AWS platform supporting multiple accounts and application teams.
Experience with platform-level configuration, governance, automation, lifecycle management, and operational support; application-only experience in an existing AWS environment does not meet this requirement.
Deep hands-on experience implementing, administering, and troubleshooting AWS Control Tower in an enterprise multi-account environment, including landing zone lifecycle management, Account Factory, account enrollment, organizational units, controls, and drift remediation.
Demonstrated experience enabling AWS services for enterprise use, including technical evaluation, architecture and security review, automated deployment patterns, testing, documentation, and operational readiness.
Working knowledge of Amazon Bedrock AgentCore, including Runtime, Gateway, Identity, Memory, and Observability, and understanding of platform responsibilities versus application-owned agent logic.
Strong Python development and automation skills.
Experience building and maintaining GitLab CI/CD pipelines.
Experience with AI and machine learning technologies and platforms.
Strong understanding of AWS architecture, cloud networking, security, and multi-account governance, including AWS Organizations, SCPs, IAM Identity Center, least-privilege access, AWS Config, and AWS CloudTrail.
Experience with Infrastructure as Code tools such as CloudFormation or AWS CDK.
Experience with containerization technologies such as Docker and Kubernetes/EKS.
Experience with Agile delivery methodologies.

Nice To Haves

Hands-on experience implementing or piloting Amazon Bedrock AgentCore, including secure tool/API connectivity, identity integration, deployment automation, and agent monitoring and troubleshooting.
Experience with Amazon Bedrock, Amazon SageMaker, or Generative AI technologies.
Experience designing and supporting enterprise cloud platforms, including AWS Control Tower adoption, landing zone migrations or upgrades, and automated account customization.
Familiarity with DevSecOps practices.
Experience with observability and monitoring tools such as CloudWatch, Datadog, Splunk, or Dynatrace.
Experience with ServiceNow, Jira, and Confluence.
Strong knowledge of Microsoft 365 products and collaboration platforms.
AWS certifications such as AWS Solutions Architect Associate or Professional, AWS DevOps Engineer Professional, or AWS Machine Learning Specialty.

Responsibilities

Lead the design, implementation, automation, and ongoing operation of AWS Control Tower and enterprise landing zones, including multi-account structures, organizational units, account provisioning and enrollment, baseline configurations, landing zone upgrades, and drift remediation.
Implement and maintain AWS Control Tower controls and account governance with security teams, integrating AWS Organizations, service control policies, IAM Identity Center, AWS Config, and centralized logging.
Drive end-to-end AWS service enablement by assessing use cases and dependencies, coordinating architecture and security reviews, defining approved configurations and access patterns, building reusable Infrastructure as Code, validating controls, and delivering production-ready services with documented support ownership.
Develop and maintain Python and Infrastructure as Code automation for account provisioning, landing zone configurations, service deployment, and platform lifecycle management.
Build and enhance GitLab CI/CD pipelines for shared platform infrastructure, account baselines, and reusable AWS service enablement patterns.
Evaluate, enable, and support AI and machine learning capabilities, particularly Amazon Bedrock AgentCore, by developing shared deployment patterns, access controls, observability, and support boundaries for Runtime, Gateway, Identity, Memory, and Observability.
Partner with AI, application, architecture, security, developer, and operations teams to deliver shared cloud platform capabilities and approved service patterns for application teams.
Implement cloud best practices related to security, scalability, resiliency, and operational excellence.
Troubleshoot and resolve complex shared AWS platform issues, including account provisioning, governance controls, identity integrations, and service enablement; collaborate with application teams to distinguish platform issues from application-owned issues.
Drive continuous improvement initiatives across cloud engineering processes and tooling.