Data Architecte Transformation H/F

GCP Architect Remote Role Job Description: GCP Organization & Multi-Tenant Foundation Own the GCP organization design end-to-end: folder hierarchy (Platform-Infrastructure, Customer-Hosting/Americas/EMEA/APAC, Engineering, OF, SE, PM, project naming conventions, IAM group model (sav-eic-* Google Groups - Least-privilege role bindings), and Organization Polloy framework (region constraints, external IP restrictions, SA key prevention, domain-restricted sharing, uniform bucket access) Define and document the per-customer tenant isolation model: dedicated GCP project + VPC + GKE cluster per environment (prod/nonprod) - full billing, permission, and operational isolation. Own trade-off analysis between this model and namespace-level isolation as customer count grows Resolve the critical open gaps in the current architecture: IPAM tooling selection, ArgoCD sharding strategy at 50-100+ clusters, PKIstrategy for SC2, Well-Architected Framework compliance gaps between MVP and production paths Networking & CGNAT Architecture Own the CGNAT (RFC 6598, 100.64.0.0/10) per-tenant addressing design: /23 CIDR allocation framework (App /24, Web /25, Mgmt /26, GKE Master /28, PSA /24), IPAM tooling selection and integration into the provisioning pipeline Design the full Connect 2.0 (SC2) architecture: HA OpenVPN topology (primary + secondary VM per tenant, different zones, CGNAT side), PKIstrategy (GP CA Service Root CA + Issuing CA), per-tenant certificate lifecycle (generation, rotation, expiry alerting, revocation). Firestore tenant config schema, Cloud Function orchestration (connect-health-probe, connect-failover, connect-failback), and . ovpn dual-endpoint bundle design Define VPC routing Logic: custom node tags - active SC2 VI For RFC-1918 ranges, pod-traf Page 10 / 14 /24 route preced + Private Service Access onfLicts Acchitent Fl.cemaLl model denu-hu-default tan-hased Lancess/encess VPC. What We're Looking For Required: ~8-12 years of infrastructure / platform engineering, with 3+ years as a principal-level technical authority on a production cloud platform ~ Deep GCP expertise - you have designed GCP organizations, multi-tenant GKE environments, VPC architectures, and IAM models for production workloads; you can defend design decisions in an Org Policy discussion as readily as a Terraform code review ~ Terraform mastery - multi-module design patterns, per-tenant factory modules, complex for each + dynamic blocks, state isolation strategy, module versioning; you have written Terraform that other engineers build on ~ ArgoCD at scale - ApplicationSets, multi-cluster agent/pull model, promotion gates, RBAC, HA- you have operated ArgoCD across 20+ clusters, not just installed it ~ Multi-tenant networking depth - CIDR management, IPAM tooling, VPC peering/PSC design, CGNAT or equivalent overlapping-address problem solving; you have solved customer CIDR conflict at scale ~ Security architecture - VPC Service Controls, Binary Authorization, Cloud KMS/CMEK, Workload Identity, IAP zero-trust, least-privilege IAM; you have designed the security model for a compliance-audited SaaS platform ~ Distributed systems intuition - you can evaluate trade-offs between Consul/Vault on VMs vs. containerized, between Elasticsearch and OpenSearch, between service mesh and no service mesh, and produce a written rationale that holds up under scrutiny ~ Strong written communication: architecture documents, decision records, and design ~ Distributed systems intuition - you can evaluate trade-offs between Consul/Vault on VMs vs. containerized, between Elasticsearch and OpenSearch, between service mesh and no service mesh, and produce a written rationale that holds up under scrutiny ~ Strong written communication: architecture documents, decision records, and design reviews are your primary output alongside code Strong Plus: HA VPN / OpenVPN architecture with per-tenant PKi at scale (cert lifecycle, rotation automation, GCP CA Service) EU Sovereign Cloud experience: GCP Assured Workloads, AWS EU Sovereign, Azure EU, SecNumCloud, BSI C5, GDPR DPA design HOK/BYOK with external KMS (Thales CipherTrust, HSM) - architectural experience, not just theoretical Temporal.io workflow architecture for multi-step provisioning orchestration Experience building agentic or Al-augmented infrastructure pipelines SOC2 Type II, ISO 27001, or PCI-DSS architecture-to-controls mapping (you've been in the audit room) Elasticsearch / OpenSearch cluster architecture at production scale Google Cloud Professional Cloud Architect certification (required within 90 days if not already held)

Create an account to see the full posting, access our search engine, and more.