Cloud Engineer — Google Cloud Platform (GCP)

Role Profile: Cloud Engineer — Google Cloud Platform (GCP)

Domain: Google Cloud Platform — Identity & Access Management (IAM)

Location: Plano, Texas

About the Role

• Own and manage identity and access on Google Cloud Platform (GCP), defining who can access which resources, in which environments, and under what conditions.
• Design and build IAM solutions that enable users and workloads to authenticate to GCP without relying on long-lived credentials.
• Implement identity and access management entirely through infrastructure-as-code (IaC), with deployments managed through automated pipelines rather than the console.
• Work in a hands-on engineering role at the intersection of public cloud and a large, regulated enterprise, operating at planet scale.

What You’ll Do

• Design and implement GCP IAM as code: Define role bindings, custom roles, and least-privilege role sets across organization, folder, and project scopes using Terraform. Ensure all changes are peer-reviewed and applied through automated pipelines.
• Manage Workforce Identity Federation entitlements: Enable enterprise users to access GCP through the organization’s identity provider, with access permissions declared in code rather than granted manually.
• Implement Workload Identity Federation: Configure federated principals to access service accounts, enabling applications and pipelines to exchange federated tokens for GCP access instead of relying on service-account keys.
• Manage the service-account lifecycle: Oversee naming, provisioning, ownership, impersonation, and the elimination of static service-account keys.
• Design and maintain the role model: Develop reusable entitlement sets that map teams or personas to the access they require, ensuring access is consistent, repeatable, and reviewable rather than bespoke.
• Review access requests against least-privilege standards: Determine the permissions granted by a role, identify excessive access, select the narrowest role that satisfies the stated requirement, and document the access decision.

Required Qualifications

• Strong hands-on Terraform experience: Ability to author, review, and deploy IAM configurations through reusable modules and CI/CD pipelines.
• Strong hands-on GCP IAM experience: Thorough understanding of the IAM policy model, permission inheritance across organization, folder, and project scopes, and the practical differences between predefined and custom roles.
• In-depth knowledge of roles and permissions: Ability to determine the permissions a role grants, identify excessive access, and select a narrower role without disrupting the intended use case.
• Understanding of Workforce Identity Federation and Workload Identity Federation: Knowledge of how human identities federate into GCP through an enterprise identity provider and how machine identities exchange federated tokens for GCP access instead of relying on static keys.

Nice to Have

• Experience with IAM Deny Policies.
• Experience with IAM Conditions and conditional role bindings.
• Experience eliminating service-account keys at scale or executing keyless migration initiatives.
• Experience designing custom roles and implementing the associated governance processes.
• Experience operating in large, regulated enterprise environments.

Impact

• Make GCP access provable by ensuring every entitlement is declared in code, every machine identity is keyless, and every access grant is defensible as the least-privilege permission set required to fulfill its intended purpose.