Family Search Software Dev Engineer 5-AWS Cloud Architect (Lehi, UT)

The Church of Jesus Christ of Latter-day Saints•Lehi, UT

17h•Onsite

About The Position

The Staff Cloud Platform Architect – Networks & IAM (AWS) leads cloud networking architecture, AWS Organization and IAM strategy, and DNS and email posture. The role defines and oversees routing, network segmentation, and secure service-to-service access patterns across AWS environments, while partnering with Security on controls, threat modeling, and incident readiness. It also contributes to architecture, URI naming, privacy, technology planning, and business continuity governance, and turns platform-user needs into reusable capabilities that improve the platform for all users. The position provides architecture oversight for existing networks and leads the design of new layered, segmented, multi-availability-zone and multi-region networks. It governs DNS and email records and domain approvals, and sets direction for AWS Organizations, account vending, service control policies, identity and access management, and privileged-access practices. The role champions production readiness and compliance within the FamilySearch SDLC, advises cross-organizational committees, and provides design leadership or advisory support for selected application infrastructure. Privileged access is a controlled responsibility requiring least privilege, sound judgment, separation of duties, auditable changes, and compliance with internal policies and legal or regulatory requirements. The work is performed in a professional office environment. Church employees use their talents to further the Church’s mission. Employment is limited to Church members worthy of a temple recommend; the Church states that it is an equal opportunity employer and provides reasonable accommodations for qualified individuals with known disabilities.

Requirements

Bachelor’s degree in computer science, a closely related field, or equivalent experience.
At least 8 years of progressive, relevant, industry-recognized professional experience.
At least 6 years in large-scale cloud networking and security architecture, including multi-account AWS environments.
Experience completing at least two major cycles of architecting entire systems and successfully implementing them through at least two development cycles.
Strong understanding of Agile software development methodologies and principles.
Evidence of external industry validation and enterprise-grade vision.
Experience evaluating vendors and their solutions and identifying critical gaps in their offerings, when applicable.
Exceptional written and verbal communication skills at all levels of the business.
Ability to interact effectively with customers, present solutions, and lead customers through decisions.
Strong understanding of the technical use cases supported by the stack or platform.
Ability to lead cross-functional and interdepartmental product or project teams, define work processes, and lead skilled engineers and managers.
Ability to keep abreast of technology trends and directions and understand their relevance to the Church.
Expertise in cloud-based platforms and services and a high-level understanding of DevSecOps.
Ability to make architectural choices grounded in sound principles and practical experience, without unsubstantiated bias.
Ability to set technical architectural direction without supervision.
Leadership in Continuous Integration and Continuous Delivery principles.
Outstanding troubleshooting ability, including thinking under pressure and driving difficult problems to resolution.
Demonstrated leadership skills and ability to mentor and train peers.
Expert-level knowledge of applicable software, computer languages, and code needed to perform the role.
Ability to work in a professional office environment.
Ability to meet physical requirements that may include sitting for long periods and using computer monitors and equipment.
Must exemplify least privilege, sound judgment, separation of duties, auditable change management, and strict adherence to internal policies and legal or regulatory requirements for privileged access.
Church membership and worthiness of a temple recommend are required for employment.

Nice To Haves

Master’s degree in a related field.
Deep hands-on experience with VPC, Transit Gateway, Direct Connect, PrivateLink, Route 53, CloudFront, ALB/ELB, WAF/Shield/Imperva, NAT, IPSec, NACLs/security groups, and cross-region traffic engineering.
Expertise in AWS IAM roles and policies, permission boundaries, federation/SSO, cross-account patterns, SCPs, RBAC/ABAC, and service-to-service authentication and authorization.
Experience designing segmented network topologies using layered trust zones and zero-trust principles, and migrating legacy firewalls to AWS-native controls.
Strong DNS competency, including A, CNAME, NS, MX, DKIM, DMARC, and SPF records, and domain lifecycle governance.
Experience partnering with Security, participating in architecture governance, and supporting incident and BCP readiness within an SDLC.
Critical thinking, communication, and influence skills, including translating complex platform needs into clear, usable patterns for product teams.
Experience operating in regulated, high-availability enterprise environments and familiarity with audit and evidence collection.
Hands-on experience with edge policies such as CORS and geo/language routing, CDN tuning, and bot or abuse mitigation.
Familiarity with AWS WorkMail, account vending and landing-zone automation, and drift detection.
Track record of leading organization-wide migrations or upgrades, such as SDK or OS baselines, and aligning teams to accessibility and production-readiness standards.
AWS Advanced Networking Specialty or Security Specialty certification, or equivalent portfolio.

Responsibilities

Provide architecture oversight for existing network topologies and lead design of new layered, segmented, multi-AZ and multi-region networks.
Own end-to-end routing architecture and traffic flows across AWS and related network, proxy, load-balancing, CDN, and cross-domain controls.
Lead redesign of complex network boundaries and firewalls to simplify operations, improve security, and reduce operational toil.
Steward cloud networking technologies, including VPCs, subnets, NACLs, security groups, routing, NAT, Transit Gateway, Direct Connect, IPSec, VPC peering and sharing, PrivateLink, static IP management, and WAN.
Govern DNS for product and corporate domains, including MX, DKIM, DMARC, and SPF records, and domain registration approvals.
Ensure DNS updates and changes use resilient, least-privilege automation and auditable workflows.
Set direction and provide oversight for AWS Organizations, including OU structure, SCPs, service integrations, account vending, and guardrails.
Define and evolve RBAC/ABAC and IAM policy strategies, including identity-, resource-, and permission-boundary patterns for secure service-to-service access across accounts and regions.
Partner with AWS Support and internal stakeholders to address platform advances and resolve high-severity issues.
Oversee AWS WorkMail and related secure email provisioning flows used in account creation.
Partner with Security to validate infrastructure posture, conduct threat modeling, codify controls, and contribute IAM expertise to Security Committee discussions.
Champion production-readiness and compliance expectations within the FamilySearch SDLC.
Serve on or advise the Architecture Review Board, URI Naming governance, future platform strategy, Privacy, Tech Plan, and Business Continuity work.
Set and maintain standards to prevent drift and namespace confusion, particularly for URI and domain usage.
Meet with platform users, identify and synthesize pain points, generalize point solutions into platform capabilities, and partner with Product Management on roadmaps and implementation.
Advance shared data and observability initiatives, such as Cloud Intelligence Dashboards and data-lake direction, to improve cost, performance, and decision-making.
Provide design and implementation leadership or advisory support for selected application infrastructure, ensuring secure, performant, compliant architectures that follow SDLC patterns.
Participate in a controlled privileged-access rotation and follow least privilege, separation of duties, auditable change management, and internal policies and legal or regulatory requirements.
Mentor and train peers, lead cross-functional teams, and set technical architectural direction.