CI&T

At CI&amp;T, we help large enterprises transform the potential of AI into real business impact with AI Deployment, AI-native execution, and tech-integrated business solutions.
With 30 years of experience in technological transformation, we accelerate innovation with expertise in Agentic SDLC, Application modernization, Data &amp; AI, Martech and Business strategy.
We are 8,000 CI&amp;Ters across more than 25 countries, collaborating to build solutions with real impact. AI is already part of how we work, evolve, and innovate every day.
You will&nbsp;co-own a multi-account AWS network foundation: hub and spoke on Transit Gateway, centralised inspection, controlled egress, hybrid connectivity into a client's SD-WAN estate through a third-party vendor. You will be in the room when the client's cloud architect asks why a subnet is a /25 and not a /24 —&nbsp;and the answer has to be yours.
The work is unglamorous in the way that matters. Most of what goes wrong in a landing zone does not go wrong in a module — it goes wrong at the seams.&nbsp;We want someone who has been burned by those and now checks for them by reflex.
Responsabilidades:
<ul>
<li>Own the network foundation&nbsp;end to end: Transit Gateway with separated inspected and uninspected route tables, VPC design across inspection, egress, ingress, shared services, and workload tiers</li>
<li>Define and enforce the&nbsp;routing posture&nbsp;that makes traffic pass a firewall rather than merely sit near one</li>
<li>Verify that posture&nbsp;by test, not by reading your own plan</li>
<li>Design and implement&nbsp;Transit Gateway Connect over GRE with BGP, two peers for availability, ASNs agreed in advance</li>
<li>Extract precise inputs from&nbsp;third-party SD-WAN vendors&nbsp;who are not on your team and do not share your deadline</li>
<li>Manage&nbsp;AWS IPAM&nbsp;with a delegated organisation administrator, pool hierarchy mapped to accounts, RAM shares to spoke accounts</li>
<li>Justify&nbsp;every prefix&nbsp;— "it looked tidy" is not an answer</li>
<li>Implement&nbsp;AWS Network Firewall&nbsp;with stateful rule groups, default drop posture, domain allowlisting, and managed threat signatures</li>
<li>Be the person who knows whether an application failing to reach the internet is&nbsp;the firewall working correctly</li>
<li>Write and maintain&nbsp;Terraform across multiple accounts&nbsp;with per-phase state separation, deployed through&nbsp;GitHub OIDC</li>
<li>Implement drift detection, static validation, and a pipeline that&nbsp;a client can inherit</li>
<li>Manage log delivery into governance accounts, resource policies,&nbsp;KMS key policies, and service-linked roles</li>
<li>Understand that these accept broken configurations silently — and&nbsp;prove delivery by watching a log arrive</li>
<li>Write down&nbsp;why: why a prefix is what it is, why an option was rejected, what a deviation is</li>
<li>Prevent the next engineer from reversing a deliberate choice&nbsp;because nobody recorded the reasoning</li>
<li>Write down&nbsp;why: why a prefix is what it is, why an option was rejected, what a deviation is</li>
<li>Prevent the next engineer from reversing a deliberate choice&nbsp;because nobody recorded the reasoning</li>
</ul>
Requisitos:
<ul>
<li>Transit Gateway: association vs. propagation (no hedging), appliance mode, and why it exists</li>
<li>VPC design: Network Firewall, NAT and egress control, PrivateLink, Route 53 Resolver</li>
<li>Hands-on with&nbsp;hub and spoke and centralised inspection&nbsp;— built it, broke it, and fixed it&nbsp;(non-negotiable)</li>
<li>Ability to describe a&nbsp;routing asymmetry you diagnosed&nbsp;or a firewall you had to prove was in the path</li>
<li>Organizations, Control Tower, OUs, SCPs, delegated administrators, RAM</li>
<li>Experience&nbsp;inheriting a landing zone&nbsp;someone else deployed</li>
<li>Module design,&nbsp;state layout across accounts and phases</li>
<li>Read a plan and know before applying whether you are renaming or&nbsp;destroying&nbsp;a resource</li>
<li>Site-to-site VPN or Direct Connect, GRE, BGP peering, route advertisement, ASN allocation</li>
<li>Default to&nbsp;checking the environment&nbsp;rather than trusting a report — including your own</li>
<li>Every serious problem was found by someone&nbsp;querying the account&nbsp;instead of reading a summary</li>
<li>Clear, precise, unhedged prose — a&nbsp;delivery skill, not a nice-to-have</li>
<li>Inglês Avançado/Fluente é obrigatório</li>
</ul>
Diferencial:
<ul>
<li>AWS Advanced Networking Specialty certification&nbsp;— or the equivalent scar tissue</li>
<li>Experience with&nbsp;SD-WAN platforms on AWS&nbsp;(Cisco, Fortinet, Palo Alto) and Transit Gateway Connect</li>
<li>Exposure to&nbsp;manufacturing or industrial environments</li>
<li>Familiarity with&nbsp;AWS Account Factory for Terraform (AFT)</li>
<li>Working fluency in both Portuguese and English&nbsp;— client conversations in English; team works in Portuguese</li>
</ul>
#LI-AM2
Our benefits:
-Health and dental insurance
-Meal and food allowance
-Childcare assistance
-Extended paternity leave
-Partnership with gyms and health and wellness professionals via Wellhub (Gympass) TotalPass;
-Profit Sharing and Results Participation (PLR);
-Life insurance
-Continuous learning platform (CI&amp;T University);
-Discount club
-Free online platform dedicated to physical, mental, and overall well-being
-Pregnancy and responsible parenting course
-Partnerships with online learning platforms
-Language learning platform
And many more!
More details about our benefits here: <a href="https://ciandt.com/br/pt-br/carreiras" rel="nofollow noopener" target="_blank">https://ciandt.com/br/pt-br/carreiras</a>
At CI&amp;T, inclusion starts at the first contact. If you are a person with a disability, it is important to present your assessment during the selection process. See which data needs to be included in the report by <a href="https://docs.google.com/presentation/d/12BqYLIGeEyp9t0ZdF2b4bvnjFLza4E8fmbcowWeBlfk/edit?slide=id.g3a9cf52bf2b_0_0#slide=id.g3a9cf52bf2b_0_0" rel="nofollow noopener" target="_blank">clicking here</a><a href="https://docs.google.com/presentation/d/12BqYLIGeEyp9t0ZdF2b4bvnjFLza4E8fmbcowWeBlfk/edit?slide=id.g3a9cf52bf2b_0_0#slide=id.g3a9cf52bf2b_0_0" rel="nofollow noopener" target="_blank">.</a>This way, we can ensure the support and accommodations that you deserve. If you do not yet have the assessment, don't worry: we can support you in obtaining it.
We have a dedicated Health and Well-being team, inclusion specialists, and affinity groups who will be with you at every stage. Count on us to make this journey side by side.

[Job- 31345]Senior DevOps Engineer (Cloud Network Foundation), Brazil

[Job- 31345]Senior DevOps Engineer (Cloud Network Foundation), Brazil

This job is no longer available

Talents

Recruiters

About