Senior GCP Cloud Architect (DevOps & Platform) | Contract | Hybrid | Agoura Hills, CA

We are looking for a Senior GCP Cloud Architect for a project-based assignment to own and evolve the Google Cloud platform that underpins our AI enablement work, across networking, IAM, security, governance, infrastructure automation, and platform engineering. This is an architect-level role that stays hands-on: you will set the direction for cloud and system design, make and defend the architectural calls, and remain close enough to the infrastructure-as-code to extend it yourself. You will maintain and evolve the existing environment, support engineering teams onboarding onto the platform, and ensure it remains secure, reliable, cost-effective, and aligned with established standards. The ideal candidate is comfortable inheriting an existing cloud environment, understanding the architecture and design decisions already in place, and improving the platform without unnecessarily rebuilding it.

Key Responsibilities:

Own and evolve our GCP landing zone across networking, IAM, security, and governance as requirements change, including the needs of AI enablement workloads.

Serve as the architectural authority for cloud and system design — set standards, run design reviews, document decisions, and guide teams toward them.

Make sure the platform is ready to support AI workloads on GCP: identity and access, network boundaries, guardrails, and a repeatable path for teams to adopt GCP AI services.

Maintain and extend our infrastructure-as-code estate and the automation that deploys it.

Support engineering teams onboarding onto the platform, and keep the self-service path smooth.

Keep the platform healthy over time: cost, security posture, reliability, and reducing drift between what’s documented and what’s running.

Advocate for DevOps practices across the organization.

Requirements:

Architect-level experience designing and owning production cloud platforms, with deep, hands-on GCP expertise — GCP is the core of this role.

Solid grounding in landing zone concepts — org hierarchy, network design, identity, org policy, and security baselines — enough to reason about ours and improve it.

Fluency with infrastructure-as-code (Terraform/OpenTofu, ideally Terragrunt) and the automation patterns around it.

Comfortable inheriting someone else’s system: able to read existing code and design decisions, understand the intent, and build on it rather than rewrite it.

Broad DevOps and platform engineering judgment — CI/CD, observability, and release safety.

Able to work independently, explain architectural trade-offs, and communicate decisions clearly to both engineers and stakeholders.

Preferred:

Strong background in authentication and authorization — e.g., OAuth 2.0/OIDC, SSO/SAML, GCP Identity Platform or Identity-Aware Proxy, Workload Identity Federation, and service-to-service auth.

Nice to Have:

AWS experience.

Encryption and key management experience — e.g., Cloud KMS, customer-managed encryption keys (CMEK), encryption in transit and at rest, and secrets management.

Experience with Gemini Enterprise, Vertex AI, or agent platforms.

Google Professional Cloud Architect or Professional Cloud DevOps Engineer certification.

Location:

Hybrid, 1 day per week onsite in Agoura Hills, California, and 4 days remote.

Employment type:

Contract