全职 GCP Cloud architect 工作, 薪水, Wipro 公司招聘中 - Ricebowl

Infrastructure as Code

• Design, build, and maintain reusable Terraform modules for core GCP services — GKE, Cloud Run, BigQuery, Cloud SQL, Pub/Sub, VPC networking, IAM, KMS, and Cloud Storage.
• Establish IaC standards, module versioning strategy, and a private module registry.
• Implement automated CI/CD pipelines for infrastructure (Cloud Build, GitHub Actions, or GitLab CI) with plan/apply gating, drift detection, and policy validation.
• Embed Policy-as-Code using Open Policy Agent (OPA/Rego), Sentinel, or GCP Organization Policies to enforce security and compliance guardrails.
• Manage Terraform state at scale (remote backends, workspace strategy, state isolation per environment).

Service Catalog

• Build and operate a self-service Service Catalog (e.g., Backstage, GCP Service Catalog, or equivalent) where developers can provision approved cloud building blocks on demand.
• Create golden-path templates and blueprints for common patterns: microservice on GKE, event-driven workload on Pub/Sub + Cloud Run, data pipeline on BigQuery, etc.
• Wrap Terraform modules into catalog items with parameterized inputs, approval workflows, and guardrail checks.
• Integrate the catalog with identity (Cloud Identity / Workforce Identity), ticketing, and observability tooling.

Security & Networking

• Design and operate landing zone networking: org hierarchy, folder/project structure, Shared VPC, hub-and-spoke topology, hybrid connectivity (Cloud Interconnect / VPN), and Private Service Connect.
• Implement network segmentation and egress controls using VPC Service Controls, firewall policies (hierarchical and network), Cloud NAT, and Private Google Access.
• Build secure-by-default modules covering IAM least-privilege, Workload Identity Federation, service account hygiene, and short-lived credentials.
• Embed encryption and key management patterns using Cloud KMS, CMEK/CSEK, and Secret Manager.
• Operationalize Security Command Center, Cloud Armor, Identity-Aware Proxy, and Binary Authorization for workload protection.