Note: The job is a remote job and is open to candidates in USA. CVS Health is building a more connected, convenient, and compassionate health care experience for individuals, families, and communities. The Principal Cloud Engineer/GCP Platform Technical Lead will own the enterprise Google Cloud Platform environment, define and operate secure landing zones and platform capabilities, and serve as the final technical authority for GCP architecture. The role also provides technical leadership, mentorship, automation, compliance, observability, and strategic planning across cloud engineering teams.
Responsibilities
- Own the enterprise GCP platform end-to-end, including organization structure, resource hierarchy, billing, networking architecture, IAM tiering, CMEK, VPC Service Controls, and centralized logging
- Define, build, and maintain the enterprise GCP Landing Zone, including Shared VPC, project factory patterns, Org Policies, and governance guardrails
- Serve as the final technical authority on GCP architecture and engineering decisions, ensuring scalability, security, reliability, and production readiness
- Establish and enforce engineering standards across Infrastructure as Code, GitOps workflows, naming conventions, tagging strategies, branching models, and deployment practices using Terraform and Kubernetes Config Connector (KCC)
- Act as the technical anchor and senior-most individual contributor for the GCP Cloud Engineering and Platform teams
- Partner closely with enterprise architecture, security, networking, operations, and application teams to translate business and regulatory requirements into scalable platform capabilities
- Collaborate across technology towers and platform teams (including AI and provisioning platforms) to enable consistent, secure, and efficient cloud adoption
- Influence cloud strategy across CSPs while driving GCP as the primary enterprise platform of choice
- Design and engineer enterprise-grade GCP networking, including Shared VPC, NCC hub-and-spoke architectures, VPC Service Controls, Private Service Connect, Cloud NAT, and hybrid connectivity using Cloud Interconnect and HA VPN
- Architect and operate secure private GKE clusters using Workload Identity, Binary Authorization, Shielded Nodes, Config Sync, and least-privilege IAM patterns
- Define identity and access strategies leveraging IAM, group-based access, PAM entitlements, Workload Identity Federation, and Entra ID integration
- Evaluate platform designs for cost efficiency, performance, resilience, and long-term sustainability
- Build and maintain self-service platform capabilities enabling product teams to deploy safely and independently
- Integrate observability as a first-class platform feature using Cloud Monitoring, Cloud Logging, Datadog, SLIs/SLOs, alerting policies, and PagerDuty
- Design and operate CI/CD and automation infrastructure, including self-hosted GitHub Actions runners on GKE using ARC
- Manage secrets and encryption lifecycle using Secret Manager, CMEK, External Secrets Operator, and automated key rotation
- Participate in on-call rotation and provide L3 escalation support for platform and infrastructure incidents
- Drive continuous, automated compliance for regulatory frameworks such as HIPAA, PCI-DSS, SOC 2, and FedRAMP
- Mentor engineers at all levels, raising the bar for cloud engineering excellence, security, and operational maturity
- Lead and participate in architecture, design, code, and security reviews for all platform changes
- Coach engineers on GCP best practices, cloud-native design patterns, and operational excellence
- Build long-term technical depth and leadership capability within the cloud engineering organization
- Evaluate and pilot emerging GCP and cloud-native capabilities, including GKE Enterprise, Vertex AI, and AI-assisted DevOps tooling
- Research modern Kubernetes, networking, and platform engineering patterns to improve scalability, security, and developer experience
- Explore AI-driven infrastructure operations and automation opportunities
- Foster a culture of disciplined experimentation with measurable outcomes
- Own and drive the GCP platform roadmap aligned with enterprise priorities and regulatory requirements
- Author, maintain, and socialize Architecture Decision Records (ADRs) for major platform decisions
- Embed FinOps practices into the platform, including cost allocation, budget alerting, committed use discounts, and rightsizing
- Influence long-term cloud transformation initiatives and ensure platform scalability aligns with business growth and compliance needs
Skills
- 10+ years of experience in infrastructure or cloud engineering, with 5+ years of deep, hands-on GCP experience at enterprise scale
- 5+ years experience with proven ownership of a GCP Organization, including resource hierarchy, billing, Org Policy, IAM, and multi-project governance
- 5+ years of demonstrated technical leadership as a principal engineer or platform owner for a major enterprise cloud initiative
- 3+ years of experience with cloud implementations best practices and well architected framework
- 6+ years of deep expertise across GCP services, including: + **Compute & Containers:** GKE (Private, Autopilot & Standard), Cloud Run, Compute Engine, MIGs + **Networking:** Shared VPC, NCC, VPC Service Controls, Private Service Connect, Cloud Armor, Interconnect, HA VPN + **Security & Identity:** IAM, Workload Identity, WIF, PAM, Binary Authorization, Security Command Center, Secret Manager, CMEK + **Data & Messaging:** BigQuery, Pub/Sub, Cloud Storage, Dataflow, Cloud Composer + **IaC & Automation:** Terraform (modules, remote state, policy-as-code), KCC, Cloud Build, GitOps + **Observability:** Cloud Operations Suite, Datadog, SLIs/SLOs, PagerDuty
- 1+ years of experience with implementing Agentic AI, and creating Agents
- Bachelor's degree in Computer Science, Engineering, or a related field, or equivalent experience (High School diploma + 4 years of relevant experience)
- Strong programming and scripting experience in Python and Go; Bash required. PowerShell experience a plus
- Experience operating and supporting production platforms in regulated environments
- Google Cloud Professional Cloud Architect and/or Professional DevOps Engineer certification
- HashiCorp Terraform Associate or Professional certification
- Experience with Palo Alto VM-Series NGFW and F5 BIG-IP VE in GCP
- Familiarity with Anthos, GKE Enterprise, and multi-cloud connectivity patterns
- Experience with Vertex AI, LLM and enterprise MLOps patterns
- Healthcare or other highly regulated industry experience (HIPAA, SOC 2, PCI-DSS, FedRAMP)
- Experience with advanced CI/CD runner infrastructure and multi-OS build environments
Benefits
- Remote/Hybrid work arrangement
- This position is eligible for a CVS Health bonus, commission or short-term incentive program in addition to the base pay range listed above.
- This position also includes an award target in the company’s equity award program.
- This full‑time position is eligible for a comprehensive benefits package designed to support the physical, emotional, and financial well‑being of colleagues and their families.
- Medical, dental, and vision coverage
- Paid time off
- Retirement savings options
- Wellness programs
Company Overview
Company H1B Sponsorship