Cloud Infrastructure Engineer

Job Overview

Position Overview

The Cloud Infrastructure Engineer is a member of the SLAC Cloud Services team responsible for designing, implementing, automating, securing, and operating infrastructure across Amazon Web Services (AWS) and Google Cloud Platform (GCP).

This position helps develop the cloud platforms, shared services, technical standards, automation, and operational practices that support SLAC’s scientific research and business operations. The engineer will work across SLAC’s hybrid environment, integrating public cloud services with on-premises infrastructure, enterprise identity, networking, cybersecurity, monitoring, and support capabilities.

The position collaborates closely with Cybersecurity, Networking, Identity and Access Management, Platform Engineering, application teams, data teams, researchers, and external service providers. Success requires strong hands-on cloud engineering experience, an infrastructure-as-code mindset, sound technical judgment, and the ability to translate requirements into secure, reliable, scalable, and supportable solutions.

Your specific responsibilities will include:

• Design, deploy, operate, and continuously improve infrastructure and shared services across a multi-cloud platform.
• Build and maintain secure AWS multi-account and GCP multi-project environments using AWS Organizations, AWS Control Tower or Landing Zone Accelerator, and the Google Cloud resource hierarchy.
• Develop reusable infrastructure-as-code modules and deployment patterns using Terraform, AWS CloudFormation, Google Cloud infrastructure tools, or equivalent technologies.
• Automate provisioning, configuration, policy enforcement, compliance validation, patching, and routine operational tasks using Python, PowerShell, Bash, or similar tools.
• Build and maintain CI/CD pipelines for cloud infrastructure and platform services.
• Collaborate with the Networking team to design and support connectivity between SLAC data centers, AWS, and GCP, including VPNs, dedicated connections, transit architectures, routing, DNS, firewalls, proxies, load balancers, and network segmentation.
• Work with Cybersecurity to translate security and compliance requirements into cloud guardrails, technical controls, monitoring, policies, and automated compliance checks.
• Partner with Identity and Access Management teams to implement federation, single sign-on, role-based access control, service accounts, workload identities, privileged-access controls, and least-privilege access.
• Integrate cloud platforms with on-premises compute, storage, directory, backup, monitoring, logging, and operational systems.
• Configure and operate security capabilities including encryption, key management, secrets management, audit logging, vulnerability management, configuration monitoring, and policy enforcement.
• Develop centralized logging, monitoring, alerting, and observability using Amazon CloudWatch, AWS CloudTrail, Google Cloud Logging and Monitoring, Splunk, and other enterprise platforms.
• Support cloud-native and containerized workloads using technologies such as Docker, Amazon ECS, Amazon EKS, Google Kubernetes Engine, and serverless computing.
• Establish backup, recovery, resilience, and disaster-recovery patterns appropriate for administrative, operational, and scientific workloads.
• Monitor cloud consumption and implement cost-management practices, including budgets, tagging and labeling standards, rightsizing, optimization, and cost-allocation reporting.
• Troubleshoot complex technical issues spanning cloud infrastructure, networking, identity, security, applications, and on-premises systems.
• Participate in architecture and security reviews, incident response, root-cause analysis, change management, and service-improvement activities.
• Create and maintain architecture diagrams, engineering standards, implementation guides, operational runbooks, knowledge articles, and support procedures.
• Evaluate new AWS and GCP services based on security, reliability, interoperability, operational readiness, supportability, cost, and mission value.
• Engage with researchers, application owners, and business teams to understand their requirements and translate them into sustainable cloud solutions.
• Provide technical guidance, knowledge transfer, and mentoring to other members of the Cloud Services team.
• Collaborate with cloud providers, implementation partners, and external subject-matter experts while ensuring that technical knowledge and operational ownership remain within SLAC.
• Participate in an on-call or after-hours support rotation when required for critical cloud services.

To be successful in this position, you will bring:

• Hands-on experience designing, deploying, or operating production infrastructure in AWS, GCP, or another major public cloud platform.
• Experience with cloud networking, compute, storage, identity and access management, logging, monitoring, and security services.
• Experience using infrastructure-as-code technologies such as Terraform or AWS CloudFormation.
• Experience with Git, version control, code review, and pull-request-based engineering practices.
• Experience automating infrastructure or operational processes using Python, PowerShell, Bash, or a comparable scripting language.
• Working knowledge of TCP/IP, routing, DNS, firewalls, load balancers, VPNs, certificates, proxies, and network-security principles.
• Working knowledge of Linux or Windows server administration.
• Understanding of cloud security principles, including least privilege, encryption, secrets management, audit logging, network segmentation, and secure configuration.
• Experience troubleshooting technical issues across infrastructure, applications, networking, identity, and security.
• The ability to communicate technical concepts, risks, dependencies, and recommendations clearly to technical and nontechnical stakeholders.
• Demonstrated ability to document solutions, share knowledge, and collaborate across technical and organizational boundaries.

The candidate best positioned to succeed with the SLAC team will also demonstrate:

• A collaborative approach to working with Cybersecurity, Networking, Platform Engineering, IAM, application teams, researchers, and service owners.
• An infrastructure-as-code mindset and a preference for reusable, automated, and supportable services over manually configured resources.
• The ability to balance security, reliability, performance, maintainability, usability, flexibility, and cost.
• Ownership of assignments from initial requirements and design through implementation, documentation, operational transition, support, and continuous improvement.
• Sound judgment when working with sensitive information, privileged access, regulated environments, and production systems.
• The ability to work effectively in an evolving cloud environment where standards, tools, and operating practices are actively being developed.
• A willingness to investigate unfamiliar technologies and collaborate with vendors or subject-matter experts when additional expertise is required.
• The ability to recognize when a solution should be standardized for broad use and when scientific or experimental workloads require additional flexibility.
• A commitment to sharing knowledge, mentoring colleagues, and reducing single points of technical dependency.
• The ability to resolve technical disagreements through evidence, testing, clear communication, and consideration of organizational requirements.

Preferred qualifications

• Production engineering experience with both AWS and GCP.
• Experience designing or operating enterprise-scale AWS landing zones or GCP organization and project structures.
• Experience with AWS Organizations, Control Tower, Landing Zone Accelerator, IAM Identity Center, Transit Gateway, VPC, Security Hub, GuardDuty, AWS Config, CloudTrail, and CloudWatch.
• Experience with Google Cloud IAM, Organization Policy Service, Shared VPC, Cloud Interconnect, Cloud Router, Cloud Logging, Cloud Monitoring, Security Command Center, and Cloud Asset Inventory.
• Experience integrating public cloud platforms with Microsoft Entra ID, Active Directory, LDAP, SAML, OAuth, OIDC, or SCIM.
• Experience with hybrid or multicloud network architecture, including centralized inspection, shared services, dedicated connectivity, and hub-and-spoke designs.
• Experience with Kubernetes, container platforms, serverless architectures, platform engineering, or developer self-service capabilities.
• Experience with policy-as-code and compliance automation using AWS Config rules, Google Cloud organization policies, Open Policy Agent, HashiCorp Sentinel, or similar technologies.
• Experience integrating cloud logs and security events with Splunk or another SIEM platform.
• Experience supporting scientific computing, research data, high-performance computing, analytics, artificial intelligence, or machine-learning workloads.
• Familiarity with NIST 800-53, FedRAMP, Department of Energy requirements, or comparable regulated-environment security frameworks.
• Experience implementing cloud financial management or FinOps practices.
• Relevant AWS, Google Cloud, Kubernetes, Terraform, networking, or security certifications.

SLAC employee competencies

• Effective decision-making: Uses sound judgment, available evidence, and organizational priorities to make timely and well-informed decisions.
• Problem solving: Identifies root causes, evaluates alternatives, and implements practical and sustainable solutions.
• Collaboration: Builds productive working relationships and contributes effectively across teams and organizational boundaries.
• Communication: Communicates technical information clearly and adapts messaging to technical, scientific, operational, and leadership audiences.
• Customer focus: Understands stakeholder needs and delivers reliable, secure, and supportable services that advance SLAC’s mission.
• Adaptability: Responds constructively to changing technologies, priorities, requirements, and operational conditions.
• Accountability: Takes ownership of commitments, communicates risks and dependencies, and follows work through completion.
• Continuous improvement: Identifies opportunities to improve automation, reliability, security, efficiency, documentation, and service delivery.

Responsibilities

Core Duties:

• Design, develop, install, and maintain operating systems, utilities, and applications software on computing systems.
• Resolve system emergencies with significant impact on the integrity of user data and systems.
• Design, configure, implement, and maintain system security strategies, policies, and procedures.
• Establish software/hardware standards and systems policies and procedures.
• Engage in long-term strategic planning with regard to systems development and integration.
• Conceptualize and implement systems within broad technical or structural frameworks.
• Perform capacity planning for system configuration, software services, network services, load distribution, and service interrelationships among computer systems.
• Act as technical expert and mentor for local computer system administration.
• Act as project leader on large-scale computing projects in which strong technical, directional, and personal leadership is necessary; assign and oversee the work of other system administrators as needed.
• Manage vendor relationships and cost-effective hardware and software maintenance agreements with vendors.

Minimum Education and Experience

Bachelor's degree and eight years of relevant experience, or a combination of education and relevant experience.

Knowledge, Skills and Abilities:

• Experience with complex, multi-system platforms and vendors.
• Experience coordinating multi-system and computing environments in independent computing facilities.
• Experience developing/implementing a business continuation and disaster recovery plan.
• Proven ability to develop appropriate plans to meet computing needs.
• Advanced ability to program in multiple programming languages in multiple operating systems.
• Proven ability to lead and work on large/complex system deployment projects in a team environment.
• Advanced knowledge of security trends and best practices.

Minimum Qualifications

• Pay Frequency Annually
• Fixed Term N
• SLAC Business Area Information Technology Directorate
• Full time or Part time Full Time
• Locations 2575 Sand Hill Rd, Menlo Park, CA, 94025, US (Remote)
• Job Schedule Full time
• Regular or Temporary Regular

*

Job Category

Information Technology Srvcs

• Posting Date 10/21/2026, 02:00 AM
• Grade K
• Job Identification 201130

Benefits that support you, and your future

----------------------------------------------

18+ PTO days per year

Health benefits start when you start

Flexible work options

World-class exercise facilities

$6000+ annual tuition and training assistance

403k plan

Mental health and wellness programs

Free and discounted commuter transportation

Applies to regular full-time positions.

The job duties listed are typical examples of work performed by positions in this job classifications and are not designed to contain or be interpreted as a comprehensive inventory of all duties, tasks and responsibilities. Specific duties and responsibilities may vary depending on department or program needs without changing the general nature and scope of the job or level of responsibility.

Employees may also perform other duties as assigned.

Consistent with its obligations under the law, the University will provide reasonable accommodation to any employee with a disability who requires accommodation to perform the essential functions of their job.

Stanford is an equal employment opportunity and affirmative action employer.

All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, protected veteran status, or any other characteristic protected by law.

As a national laboratory, SLAC National Accelerator Laboratory is responsible for Homeland Security Presidential Directive 12 (HSPD-12) and Department of Energy (DOE) Order 473.1A, which requires employees to obtain and maintain a HSPD-12 Personal Identity Verification (PIV) Credential.

To obtain this credential, employees must successfully complete the applicable tier of federal background investigation post hire and receive a favorable federal adjudication. The tier of federal background investigation will be determined by job duties and national security or public trust responsibilities associated with the job.

All tiers of investigation include a declaration of illegal drug activities, including use, supply, possession, or manufacture within the last 1 to 7 years (depending on the applicable tier of investigation), illegal drug activities include marijuana and cannabis derivatives, which are still considered illegal under federal law, regardless of state laws.

For foreign national candidates

If you have not resided in the U.S. for three consecutive years, you are not eligible for PIV credential and instead will need to obtain a favorable Local Site Specific Only (LSSO) Federal risk determination to maintain employment. Once you meet the three year residency requirement, you will be required to obtain a PIV credential to maintain employment.

The tier of federal background investigation required to obtain the credential will be determined by job duties at the time you become eligible for the PIV credential.