About Gruve

Gruve is an innovative software services startup dedicated to transforming enterprises to AI powerhouses. We specialize in cybersecurity, customer experience, cloud infrastructure, and advanced technologies such as Large Language Models (LLMs). Our mission is to assist our customers in their business strategies utilizing their data to make more intelligent decisions. As a well-funded early-stage startup, Gruve offers a dynamic environment with strong customer and partner networks.

Position Summary

AWS Cloud Architect responsible for designing, building, and owning the complete AWS foundation for Gruve's Cisco ISE-as-a-Service (ISEaaS) multi-tenant managed service, with 8+ years of experience in cloud infrastructure and network security environments. Owns the AWS Organization and multi-account landing zone, tenant network architecture, security guardrails, Infrastructure-as-Code, and cloud cost management. This is a hands-on build role: the successful candidate will personally author Terraform modules and design the account structure that every customer tenant is provisioned from, while applying reliability engineering practices to reduce operational toil. Working knowledge of Cisco ISE, RADIUS, and enterprise network security concepts.

Key Responsibilities

Design and implement multi-account AWS Organization structure, including Organizational Units (OUs), management account separation, and consolidated billing.
Design and enforce Service Control Policies (SCPs) and organization-level guardrails for tenant isolation and compliance.
Design tenant network architecture: VPC, multi-AZ subnet design, route tables, VPC endpoints, NAT, DNS (Route 53 private zones including PTR records), and IP address management (IPAM).
Design, implement and maintain centralized AWS egress architectures using AWS Network Firewall, NAT Gateways and Transit Gateway to enforce consistent outbound traffic controls, security policies, traffic inspection and centralized logging across multi-account environments.
Implement AWS Transit Gateway hub-and-spoke connectivity with per-tenant route tables, Site-to-Site VPN, and Direct Connect.
Implement AWS security services: IAM and IAM Identity Center (SSO), KMS customer-managed keys, CloudTrail, AWS Config, GuardDuty, and Security Hub.
Own cloud cost management and FinOps: per-tenant cost attribution, tagging strategy, budget alerts, Cost Explorer and CUR-based chargeback reporting, and cost modeling to support service pricing and margin analysis.
Design for high availability and disaster recovery across Availability Zones and regions, including backup, restore, and recovery runbooks.
Apply reliability engineering practices: automation-first operations, toil reduction, failure-mode analysis, and infrastructure observability.
Implement policy-as-code and security scanning in CI/CD pipelines (Checkov, tfsec, or equivalent).
Partner with automation and ISE engineering teams to ensure infrastructure outputs integrate cleanly with configuration management.
Subscribe to and manage the Cisco ISE AMI listing on AWS Marketplace per Region, including EULA acceptance and AMI version/release validation before each tenant build.
Verify and manage AWS service quotas (EC2 instance types, EIPs, VPC limits) per Region/tenant.
Configure Network ACLs and manage Elastic IP allocation policy (use only where explicitly required; avoid public exposure of ISE by default).
Enable VPC Flow Logs for tenant VPCs/subnets where required by security or compliance standards.
Configure EC2 instance metadata options (IMDSv2) and other instance-level hardening attributes.
Own EC2 user-data / bootstrap configuration for the ISE AMI (hostname, management IP, NTP, DNS) so it hands off cleanly into the Platform Automation Engineer's post-bootstrap automation.
Define NTP source design for ISE nodes alongside the existing DNS/Route 53 design.
Own the end-to-end AWS infrastructure validation checklist (EC2, EBS, security groups, routing, DNS, NTP, IAM, encryption, monitoring) at each tenant go-live.