Note: The job is a remote job and is open to candidates in USA. CVS Health is focused on creating a more connected, convenient, and compassionate health care experience. The company is seeking a Principal Cloud Infrastructure Engineer to own and lead its enterprise GCP platform, establish secure and scalable cloud architecture, and guide technical direction. The role involves hands-on engineering, infrastructure automation, platform governance, networking, security, compliance, observability, and mentoring cloud engineers.
Responsibilities
- Own the enterprise GCP platform end-to-end: organization structure, resource hierarchy, networking architecture while collaborating with several teams to ensure the platform is stable and compliant
- Define and maintain the GCP landing zone — Shared VPC, Org Policies, and project factory patterns — as the foundation all product teams build on
- Serve as the one of the final technical authorities on GCP engineering decisions, reviewing designs for scalability, security, and operational excellence before they reach production
- Build self-service platform capabilities that enable product engineering teams to move fast without compromising standards
- Lead the GCP cloud engineering team as the technical anchor — set direction, conduct design reviews, unblock engineers, and drive delivery on platform initiatives
- Establish and enforce engineering standards: IaC patterns, naming conventions, tagging strategy, branching models, and deployment practices
- Mentor engineers at all levels, building depth on the team and raising the bar on what “excellence” looks like in cloud engineering
- Partner with architecture, security, operations, and business stakeholders to translate enterprise requirements into platform capabilities
- Drive Infrastructure as code as a core principle — reusable modules, pipeline integration, state management, and policy guardrails
- Build and maintain CI/CD pipelines using Cloud Build, GitHub Actions, and Artifact Registry for both platform infrastructure and application teams
- Write production-quality automation to extend platform functionality, integrate GCP APIs, and eliminate operational toil
- Implement policy-as-code using OPA, Config Connector, and GCP Org Policies to enforce governance at scale without manual gatekeeping
- Architect/Engineer GCP networking: Shared VPC, VPC Service Controls, Private Service Connect, NCC, Cloud NAT, and hybrid connectivity via Cloud Interconnect and HA VPN
- Own the enterprise security posture on GCP — Workload Identity Federation, Binary Authorization, Secret Manager, IAM least-privilege design, and SIEM/CSPM integration (Security Command Center, Prisma Cloud, or Wiz)
- Drive continuous automated compliance across applicable regulatory frameworks (HIPAA, PCI, SOC 2) so controls are enforced in real time, not discovered at audit
- Integrate observability — Cloud Operations Suite, Datadog, and SLO/SLI frameworks — as a first-class platform capability across all workloads
- Own the GCP platform roadmap, evaluating new GCP services and capabilities and making deliberate decisions about what the enterprise adopts and when
- Incorporate FinOps practices across the platform: committed use discounts, rightsizing, budget alerting, and cost allocation as engineering disciplines, not afterthoughts
- Research and pilot emerging GCP capabilities like — Vertex AI, GKE Enterprise, Duet AI for DevOps — evaluating their fit for enterprise adoption
- Foster a culture that drive collaboration across teams and towers to shape the future of cutting-edge cloud technology adoption
Skills
- 10+ years in cloud and infrastructure engineering with 5+ years of deep, hands-on GCP experience at enterprise scale
- Proven ownership of a GCP organization — Resource Hierarchy, Billing, Org Policy, IAM, and multi-project governance in production
- Demonstrated technical leadership: you have led a platform team or major enterprise cloud initiative, set technical direction, and grown engineers around you
- Compute & Containers: GKE (Autopilot + Standard), Cloud Run, Compute Engine, MIGs
- Networking: Shared VPC, VPC Service Controls, Private Service Connect, Cloud Armor, Interconnect
- Data & Messaging: BigQuery, Pub/Sub, Cloud Storage, Dataflow, Cloud Composer
- Security: IAM, Workload Identity, SCC, Binary Authorization, Secret Manager, VPC-SC
- IaC & Automation: Terraform (modules, remote state, OPA), Cloud Build, Config Connector
- Observability: Cloud Operations Suite, Datadog, SLO/SLI design, PagerDuty integration
- Languages: Python and Go (required); Bash proficiency expected
- Bachelor's degree in Computer Science, Engineering, or a related field — or equivalent demonstrated experience
- Google Cloud Professional Cloud Architect certification (strongly preferred)
- Google Cloud Professional DevOps Engineer certification
- HashiCorp Terraform Associate or Professional certification
- Experience in regulated industries applying HIPAA, PCI-DSS, or FedRAMP controls on GCP
- Familiarity with Anthos, GKE Enterprise, and multi-cloud connectivity patterns
- Experience with Vertex AI platform and MLOps patterns on GCP
Benefits
- This full‑time position is eligible for a comprehensive benefits package designed to support the physical, emotional and financial well‑being of colleagues and their families.
- Medical, dental, and vision coverage
- Paid time off
- Retirement savings options
- Wellness programs
- Other resources, based on eligibility
- CVS Health bonus, commission or short-term incentive program in addition to the base pay range listed above
- An award target in the company’s equity award program
Company Overview