Senior GCP Cloud Platform Engineer - Landing Zone / Terraform

Lanthos is hiring a hands-on Senior GCP Cloud Platform Engineer to design and implement secure Google Cloud landing zones for regulated public-sector programs. This role is focused on real cloud foundation delivery: GCP organization structure, project and folder hierarchy, IAM, Shared VPC networking, Terraform automation, logging, monitoring, security controls, and production-ready handoff documentation., * Design and implement GCP landing-zone foundations, including organization, folder, project, naming, labeling, and policy structures.

• Build and maintain Terraform-based infrastructure for repeatable GCP deployments across development, pre-production, and production environments.
• Implement IAM, service accounts, Cloud Identity groups, SSO/federation patterns, least-privilege access, and resource hierarchy controls.
• Design and configure Shared VPC networking, subnets, firewall policies, routing, Cloud NAT, Private Google Access, and network logging.
• Configure Cloud Logging, Cloud Monitoring, alerting policies, audit logs, and operational visibility for GCP projects and services.
• Implement or support regulated-cloud controls such as Assured Workloads, VPC Service Controls, Cloud Armor, Security Command Center, encryption, and organizational policies.
• Work with security and compliance stakeholders to provide evidence for IAM matrices, network diagrams, data flows, technical design documents, and ATO/compliance packages.
• Collaborate with AI, application, API, and security engineers to ensure the landing zone supports Vertex AI, Cloud Run, API gateway, and other enterprise workloads.
• Support testing, validation, production rollout, knowledge transfer, and day-2 operational handoff.

• 5+ years cloud infrastructure experience, including 3+ years with Google Cloud.
• Proven experience designing, implementing, or modernizing GCP landing zones or cloud foundation environments.
• Strong hands-on Terraform / Infrastructure as Code experience in production or enterprise environments.
• Deep working knowledge of GCP IAM, service accounts, Cloud Identity, VPC networking, firewall policies, Cloud NAT, Cloud Logging, Cloud Monitoring, and audit logging.
• Experience implementing cloud governance patterns such as folder/project structures, org policies, naming standards, tagging/labeling, cost controls, and environment separation.
• Experience working in regulated, federal, public-sector, financial services, healthcare, or other compliance-sensitive environments.
• Comfortable producing technical design documents, implementation notes, code samples, network diagrams, IAM matrices, and handoff/runbook materials.
• Strong communication skills and ability to work directly with architects, security teams, project managers, and customer technical stakeholders.

Nice to have:

• Google Professional Cloud Architect, Cloud Network Engineer, Cloud DevOps Engineer, or Cloud Security Engineer certification.
• Experience with Assured Workloads, VPC Service Controls, NCC/Partner Interconnect, Security Command Center, FedRAMP, NIST 800-53, or IRS Pub 1075.
• Experience supporting Vertex AI, Gemini, Cloud Run, Apigee, Document AI, BigQuery, Splunk, or enterprise SIEM integrations.
• Familiarity with CI/CD tools such as GitHub Actions, Cloud Build, Jenkins, or GitLab CI.

$100 - $140 an hour - Full-time, Contract