Family Search Software Dev Engineer 5-AWS Cloud Architect (Lehi, UT)

The Church of Jesus Christ of Latter-day Saints•Lehi, UT

About The Position

The Staff Cloud Platform Architect – Networks & IAM (AWS) leads cloud networking architecture, AWS Organization and IAM strategy, and DNS and email posture. The role owns patterns for routing, segmentation, and service-to-service security; partners with Security on controls and incident readiness; contributes to architecture, URI naming, privacy, technology planning, and business continuity; and develops generalized solutions for platform users. The position requires strong AWS networking and IAM expertise, disciplined software development lifecycle practices, and clear, empathetic leadership. It also supports technology that furthers the mission of the Church and reflects the eternal impact of the gospel. Candidates at early, mid, and late career stages are encouraged to apply if they have the posted skills and abilities. The architect oversees existing network topologies and leads the design of new, layered and segmented networks across availability zones and regions. The role governs routing and traffic flows, DNS and email records, AWS Organizations and access-control strategies, and secure automation. It partners with Security to validate infrastructure posture, drive threat modeling, codify controls, and support governance and incident readiness. The architect also advises cross-organizational committees, establishes standards for URI and domain usage, works with platform users and product management to turn specific pain points into shared platform capabilities, and provides design or implementation leadership for selected application infrastructure. The role participates in a controlled privileged-access rotation, potentially including Organization Admin access and protected break-glass processes. Elevated access is treated as a responsibility requiring least privilege, sound judgment, separation of duties, auditable change management, and strict adherence to internal policies and legal and regulatory requirements. The job operates in a professional office environment; performing essential functions may require sitting for long periods and using computer monitors and equipment.

Requirements

Bachelor’s degree in computer science, a closely related field, or equivalent experience.
Eight years of industry-recognized, progressive, relevant professional experience.
Six or more years in large-scale cloud networking and security architecture, including multi-account AWS environments.
Experience completing at least two major cycles of architecting entire systems and successfully implementing them through at least two development cycles.
Strong understanding of Agile software development methodologies and principles.
Clear evidence of external industry validation and enterprise-grade vision.
Experience evaluating vendors and their solutions and identifying critical gaps in their offerings, when applicable.
Exceptional written and verbal communication skills at all levels of the business.
Ability to interact effectively with customers, present solutions, and lead customers through decision-making.
Strong understanding of the technical use cases supported by the stack or platform.
Ability to lead cross-functional and interdepartmental product or project teams, define work processes, and lead highly educated and skilled engineers and managers.
Expertise in cloud-based platforms and services and a high-level understanding of DevSecOps.
Ability to make architectural choices based on sound principles and practical experience, without unsubstantiated bias.
Ability to set technical architectural direction without supervision.
Strong understanding of continuous integration and continuous delivery principles.
Outstanding troubleshooting ability, including thinking under pressure and driving difficult problems to resolution.
Demonstrated leadership skills and ability to mentor and train peers.
Expert-level knowledge of applicable software, computer languages, and code needed to perform the role.
Ability to exemplify least privilege, impeccable judgment, separation of duties, auditable change management, and strict adherence to internal policies and legal and regulatory requirements.

Nice To Haves

Master’s degree in a related field.
Hands-on expertise with VPC, Transit Gateway, Direct Connect, PrivateLink, Route 53, CloudFront, ALB/ELB, WAF/Shield/Imperva, NAT, IPSec, NACLs/security groups, and cross-region traffic engineering.
Expertise in AWS IAM roles and policies, permission boundaries, federation/SSO, cross-account patterns, SCPs, RBAC/ABAC, and service-to-service authentication and authorization.
Experience designing segmented network topologies using layered trust zones and zero-trust principles, and migrating legacy firewalls to AWS-native controls.
Strong DNS knowledge, including A, CNAME, NS, MX, DKIM, DMARC, and SPF records, and domain lifecycle governance.
Experience partnering with Security, participating in architecture governance, and supporting incident and business continuity readiness within an SDLC.
Experience operating at enterprise scale in regulated, high-availability environments, including audit and evidence collection.
Hands-on experience with edge policies such as CORS and geo/language routing, CDN tuning, and bot and abuse mitigation.
Familiarity with AWS WorkMail, account vending and landing-zone automation, and drift detection.
Track record of driving organization-wide migrations or upgrades, such as SDK or OS baselines, and aligning teams to accessibility and production-readiness standards.
AWS Advanced Networking Specialty or Security Specialty certification, or an equivalent portfolio.

Responsibilities

Provide architecture oversight for existing network topologies and lead the design of new layered, segmented, multi-AZ and multi-region networks.
Own end-to-end routing architecture and traffic flows across cloud and on-premises services, edge controls, load balancers, reverse proxies, and cross-domain controls.
Lead re-architecture of complex network boundaries and firewalls to simplify security reasoning and reduce operational work.
Steward AWS networking technologies, including VPCs, subnets, NACLs, security groups, routing, NAT, Transit Gateway, Direct Connect, IPSec, VPC peering and sharing, PrivateLink, static IP management, and WAN.
Govern DNS for product and corporate domains, including email authentication records and domain registration approvals.
Ensure DNS changes are automated with least privilege and auditable workflows.
Set direction and provide oversight for AWS Organizations, including OU structure, SCPs, service integrations, account vending, and guardrails.
Define and evolve RBAC, ABAC, and IAM policy strategies for secure service-to-service access across accounts and regions.
Partner with AWS Support and internal stakeholders to track platform advances and resolve high-severity issues.
Oversee secure AWS WorkMail hosting used in account creation and related provisioning flows.
Partner with Security to validate infrastructure posture, drive threat modeling, codify controls, and contribute IAM expertise to Security Committee discussions.
Champion production-readiness and compliance expectations within the FamilySearch SDLC.
Serve on or advise the Architecture Review Board, URI Naming governance, future platform strategy, Privacy, Tech Plan, and Business Continuity work.
Set and maintain standards for URI and domain usage to prevent drift and namespace confusion.
Meet with platform users, identify and synthesize pain points, generalize solutions into platform capabilities, and partner with product management on roadmap and implementation.
Advance shared data and observability initiatives, such as Cloud Intelligence Dashboards and data lake direction, to improve cost, performance, and decision-making.
Provide design, implementation, or advisory leadership for selected services, ensuring secure, performant, compliant architectures that follow SDLC patterns.
Participate in a controlled privileged-access rotation and follow least-privilege, separation-of-duties, auditable-change, and policy requirements.
Lead cross-functional and interdepartmental product or project teams, define work processes, and lead skilled engineers and managers.
Mentor and train peers, communicate solutions to customers and business stakeholders, and guide customers through decisions.
Keep abreast of technology trends and assess their relevance to the Church.
Lead continuous integration and continuous delivery principles and troubleshoot difficult issues through resolution.