Sr Cloud Governance Engineer

About this role

This is a senior governance role on a small, globally distributed team, which means you will own outcomes rather than tickets. You will set the standards our multi-cloud estate runs by, make them enforceable in code, prove they are working, and defend them to the engineering teams they constrain. You will also be the person leadership asks when they want to know what our real exposure is.

This is not a build-and-operate role. We are not looking for someone to run infrastructure. We are looking for someone who has governed infrastructure that other people run.

Two things matter as much as the technical bar. First, independence: your manager and several of your key stakeholders are based in the United States, so you will need to set your own priorities and make progress without daily direction. Second, communication: a large part of this job is explaining technical risk to people who do not work in the cloud, in writing and live, in English, to Finance, Security, Product, and executive audiences.

About our estate: roughly 70% Google Cloud, with AWS and Azure in scope as secondary platforms. GCP is where the majority of the work sits, so deep hands-on GCP experience is a hard requirement rather than a preference.

Key Responsibilities

• Own the cloud governance roadmap: decide what gets standardized, in what order, and how it gets enforced across GCP, AWS, and Azure
• Author and maintain the policies and standards that engineering teams build against, and implement them as preventative controls using GCP Organization Policy, AWS SCPs and Config, and Azure Policy
• Own the exception and waiver process end to end, including the judgment calls: what gets approved, for how long, and under what compensating control
• Drive consolidation and consistency of Infrastructure-as-Code across a fragmented estate, including module standards, review gates, and policy-as-code in the pipeline
• Partner with Security to set and enforce IAM and network security standards, and lead reviews of access models and privilege boundaries
• Define the governance metrics that matter and build the dashboards behind them: posture, key and credential rotation, policy violations, drift, and remediation time
• Own cost governance: labeling and tagging standards, spend attribution and showback, anomaly detection, commitment and discount coverage, and holding teams accountable for waste
• Automate governance work rather than scaling it with headcount, including scripted enforcement, automated evidence gathering, and use of AI tooling where it removes manual effort
• Represent governance to IT, Finance, Security, DevOps, Cloud Architects, Product Engineering, and leadership across regions, and translate technical risk into the terms each of those audiences makes decisions in
• Act as the escalation point and technical reference for governance questions, and mentor others on the team

Requirements

• 7+ years working in public cloud environments, including 4+ years hands-on with GCP
• Track record of owning a cloud governance function or materially maturing one, with specific examples of standards you wrote and controls you put in place
• Deep hands-on experience with preventative guardrails across at least two hyperscalers (GCP Organization Policy, AWS SCPs and Config, Azure Policy), including how you handled the disruption enforcement caused
• Experience designing and running an exception or waiver process, including making and defending the risk calls yourself
• Advanced Terraform, including module design and standardization across multiple teams, plus policy-as-code in CI (OPA, Conftest, Sentinel, or equivalent)
• Python for automation, enforcement, and reporting
• Strong command of cloud IAM, network security, encryption, and key and secret management
• Proven ability to present technical risk to senior non-technical stakeholders, including Finance and executive audiences, and to negotiate with engineering teams that push back. This is central to the role and we will test it during the interview process
• Ability to operate independently across time zones, with regular overlap with colleagues based in the United States
• Professional written and spoken English

Preferred Qualifications

• Google Cloud Professional Cloud Security Engineer or Professional Cloud Architect certification
• AWS certification
• Cloud cost tooling: GCP billing exports and BigQuery, AWS Cost Explorer, or a third-party platform such as Cloudability or Apptio
• Experience reviewing and approving third-party cloud services entering an enterprise estate
• Familiarity with the control frameworks our platform is audited against (SOC 2, HIPAA, GDPR). You will not own audits in this role, but context helps you prioritize
• Kubernetes governance and policy enforcement
• Okta integration, Microsoft Active Directory Federation Services
• Experience applying AI or agentic tooling to governance and compliance automation
• Bachelor's degree in Computer Science, Engineering, or another relevant technical field
• Result oriented, self-starter

        This role is hybrid and requires 3 days a week in office.