Full Time Senior IT Consultant (Cloud Engineering) Jobs, in Singapore Institute Of Technology - Maukerja

Job Description

Senior IT Consultant (Cloud Engineering)

Posting Start Date: 13/10/2026

Schemes of Service: Corporate

Division: Communications & Information Technology

Employment Type: Fixed Term

The Senior IT Consultant (Cloud Engineering) plays a key role in designing, building and operating the University's cloud platforms across AWS and Microsoft Azure. This role ensures that applications, integrations and AI-enabled services run securely, reliably and cost-effectively on a governed foundation.

In this hands-on delivery and operations role, the Senior IT Consultant will build and troubleshoot solutions directly, owns assigned platform workstreams end to end, and takes responsibility for production reliability. Working alongside the Lead IT Consultant (Cloud Engineering), this role will translate cloud standards and reference architectures into working, repeatable platform capabilities.

Key Responsibilities

• Cloud Platform Engineering (AWS and Azure)
• Design, build and operate secure, scalable infrastructure on AWS and Azure across compute, storage, networking, identity and managed services, following the AWS and Azure Well-Architected Frameworks.
• Implement and extend the multi-account AWS environment (AWS Organizations, AWS Control Tower, service control policies, account vending) and the Azure Landing Zone (management groups, subscriptions, Azure Policy).
• Engineer cloud and hybrid networking with the network team: VPC and VNet design, hub-and-spoke and Transit Gateway, private endpoints, DNS, and VPN, Direct Connect or ExpressRoute connectivity to on-premises.
• Build and operate container and serverless platforms (Amazon ECS and Fargate, Amazon EKS, Azure Container Apps, AWS Lambda, Azure Functions), including upgrade and patching lifecycles.
• Integrate cloud platforms with Microsoft Entra ID for single sign-on, role-based and privileged access, applying least privilege and secretless workload identity (managed identities, federated credentials, IAM roles) wherever supported.
• Translate application and user requirements into infrastructure designs, sizing and implementation plans.
• Infrastructure as Code and automation
• Provision and manage cloud infrastructure as code using Terraform, with HCP Terraform (Terraform Cloud) for state and runs, and CloudFormation, Bicep or ARM templates where appropriate.
• Build and maintain reusable, versioned Terraform modules aligned to CIT naming, tagging and state management standards.
• Automate operational tasks with Python, PowerShell or Bash and cloud-native automation (AWS Systems Manager, Amazon EventBridge, AWS Lambda, Azure Automation, Azure Logic Apps).
• Detect and remediate configuration drift, and keep development, staging and production environments reproducible.
• DevSecOps and CI/CD
• Design, build and operate secure CI/CD pipelines in GitLab CI/CD and GitHub Actions for infrastructure, container and serverless deployments to AWS and Azure.
• Use OpenID Connect (OIDC) federation from pipelines to AWS IAM and Microsoft Entra workload identity, removing long-lived access keys and client secrets.
• Embed security in pipelines: static code analysis, dependency and container image scanning, IaC scanning (for example, Checkov or Trivy), secrets detection, artifact signing and approval gates.
• Implement policy as code (service control policies, Azure Policy, Sentinel or Open Policy Agent) to enforce guardrails before and after deployment.
• Support development teams on branching strategy, environment promotion, release governance and rollback.
• API Platform Management and Integration
• Design, implement and operate the University's API management platform (Amazon API Gateway and/or Azure API Management), including gateways, developer portal, products and subscriptions.
• Onboard APIs as integration points between systems, covering OpenAPI 3.x specifications, versioning, environment promotion and deprecation.
• Secure APIs with OAuth 2.0 and OpenID Connect through Microsoft Entra ID, mutual TLS where required, web application firewall, throttling, quotas and rate limits, using the OWASP API Security Top 10 (2023) as a checklist.
• Monitor API availability, latency, usage and errors, and tune caching and backend resilience (timeouts, retries, circuit breakers).
• Extend the API platform as an AI gateway for model endpoints: token-based limits, usage attribution, logging and routing across model providers.
• Build event-driven and asynchronous integrations (Amazon EventBridge, SQS and SNS, Azure Service Bus, Azure Event Grid) where they suit the use case.
• AI Platform Enablement
• Provision and operate cloud infrastructure for SIT's AI platform services, including Amazon Bedrock and Azure AI Foundry (Azure OpenAI), with private networking, identity integration, quotas and cost controls.
• Implement and operate the AI gateway layer that centralizes model access, authentication, guardrails, logging and chargeback for University teams.
• Deploy and secure Model Context Protocol (MCP) servers and agent integrations (for example with Microsoft Copilot Studio or Amazon Bedrock AgentCore) using managed identity and least-privilege access.
• Apply platform guardrails for AI workloads: model allowlisting, content filtering, region restrictions and PDPA-aligned data handling, with the OWASP Top 10 for LLM Applications and for Agentic Applications as references.
• Build AI-assisted operations, such as agents and automations for incident triage, cost and compliance reporting, and infrastructure queries.
• Use AI coding assistants and agents (for example GitHub Copilot, Claude Code or equivalent) in daily engineering for IaC authoring, code review, troubleshooting and documentation, with human review of every change.
• Security, Governance and Compliance
• Work with IT Security to design and implement controls for cloud infrastructure and applications: encryption and key management (AWS KMS, Azure Key Vault), secrets management, network segmentation, WAF and DDoS protection.
• Operate cloud security services (AWS Security Hub, Amazon GuardDuty, AWS Config, IAM Access Analyzer, Microsoft Defender for Cloud) and remediate findings within agreed timelines.
• Maintain compliance with PDPA, SIT IT security policies and relevant industry standards (for example, CIS Benchmarks and ISO/IEC 27001 controls). Support audits, framework reviews, risk assessments, and vulnerability assessment and penetration testing (VAPT).
• Contribute to cloud standards, guardrails, design guidelines and governance artifacts such as architecture decision records (ADRs).
• Operations, Resilience and Cost
• Own production reliability for assigned platforms through monitoring, alerting, logging and tracing (Amazon CloudWatch, AWS CloudTrail, Azure Monitor, Log Analytics or equivalent).
• Respond to incidents and alerts, lead root-cause analysis, implement corrective and preventive actions, and maintain runbooks.
• Design, document and test backup and disaster recovery plans against agreed RPO and RTO targets (AWS Backup, Azure Backup, Azure Site Recovery or equivalent), and run DR exercises.
• Apply FinOps practices: tagging and cost allocation, budgets and anomaly alerts, rightsizing, Savings Plans and Reserved Instances, and regular cost reviews with workload owners.
• Plan capacity, patching and lifecycle upgrades (for example Kubernetes version upgrades) with minimal service disruption.
• Delivery, Collaboration and Enablement
• Deliver cloud projects from requirements and design through implementation, testing, migration, handover and operations, managing risks, dependencies and timelines.
• Coordinate vendors and delivery partners, and review their designs, IaC and deliverables against SIT standards.
• Work with AWS and Microsoft account and support teams on technical issues, service limits and roadmap items.
• Produce clear technical documentation: designs, diagrams, runbooks and standard operating procedures.
  
  

Job Requirements

• Degree in Computer Science, Information Technology, Computer or Software Engineering, or a related discipline.
• At least 8 years of hands-on infrastructure or cloud engineering experience, including a minimum of 3 years designing and operating production workloads on AWS and/or Azure (strong in one, working knowledge of the other).
• Strong hands-on Terraform or equivalent IaC experience, including module development and remote state management.
• Hands-on CI/CD experience with GitLab CI/CD, GitHub Actions or Azure DevOps, including secure pipeline practices.
• Solid understanding of cloud networking (VPC and VNet design, routing, DNS, private connectivity, firewalls) and identity (IAM, Microsoft Entra ID, SSO, RBAC, federation).
• Experience with Docker and at least one container platform (Kubernetes, Amazon EKS, Azure Kubernetes Service or Amazon ECS).
• Working knowledge of API management (Amazon API Gateway, Azure API Management or equivalent), REST and OpenAPI, and OAuth 2.0 and OpenID Connect.
• Scripting proficiency in Python, plus Bash or PowerShell.
• Practical understanding of generative AI services on the cloud (for example, Amazon Bedrock or Azure OpenAI), including their security and cost considerations, and demonstrated everyday use of AI tools in engineering work.
  
  

Candiates With The Following Experience Will Have An Advantage

• Multi-account AWS (AWS Control Tower, AWS Organizations, service control policies) and Azure Landing Zone implementation.
• HCP Terraform (Terraform Cloud), Sentinel or Open Policy Agent.
• Building or operating an AI gateway, MCP servers or agent integrations (for example, Microsoft Copilot Studio, Amazon Bedrock AgentCore).
• Event-driven integration patterns, API developer portals and API security testing.
• Microsoft Power Platform or Azure Logic Apps integration with cloud services.
• Experience in higher education, public sector or other regulated environments and familiarity with PDPA.
• Coordinating vendors or delivery partners on cloud projects.
  
  

Professional Certifications Are An Advantage And May Include

• AWS: AWS Certified Solutions Architect (Associate or Professional); AWS Certified DevOps Engineer (Professional);
• Azure: Azure Administrator Associate (AZ-104); Azure Solutions Architect Expert (AZ-305); DevOps Engineer Expert (AZ-400).
• IaC and containers: HashiCorp Certified Terraform Associate; Certified Kubernetes Administrator (CKA).
• Artificial Intelligence: AWS Certified AI Practitioner; AWS Certified Machine Learning Engineer (Associate); Microsoft Certified Azure AI Engineer Associate.