Cloud Engineer Job Description (AWS, Azure, GCP)

The short answer

A cloud engineer job description should name the cloud, the accounts or subscriptions the person will own, and the cost and reliability outcomes expected, not a list of services. Use the template below, swap in the AWS, Azure or Google Cloud variant, add the architect lines if the role designs rather than builds, and screen each responsibility with one scenario.

Hiring for this?

Conntal places cloud engineers on contract, contract-to-hire or direct hire, each screened by a practitioner before you see a CV.

Cloud postings tend to list every service the provider sells, which tells a candidate nothing about the job and invites people who have only read the console. This page gives a template you can paste, per-cloud differences, an architect variant and a question for each responsibility. ConnTal's cloud engineers are screened by the platform engineering practice at Ace8 on a real cost and architecture scenario.

Copy-ready cloud engineer job description

Paste this, replace the capitalised placeholders, and delete any line that is not true of the job.

Title

Senior Cloud Engineer, [AWS, AZURE OR GOOGLE CLOUD]. Name the cloud in the title. Use Cloud Architect only if the architect section below describes your job.

About the role

[COMPANY] runs [WORKLOADS] on [CLOUD] across [NUMBER OF] accounts, subscriptions or projects. You will own the cloud foundation (accounts, networking, identity and managed services), keep it secure and cost-controlled, and be the escalation point when it fails. You work with [TEAMS] and report to [MANAGER TITLE].

What you will do

Design and operate the account or subscription structure, networking and identity model for [ENVIRONMENTS].
Provision everything through infrastructure as code in [TERRAFORM OR PROVIDER-NATIVE TOOL], reviewed and applied through a pipeline.
Operate managed services in production: [DATABASES, MESSAGING, CONTAINER PLATFORM].
Own cloud cost: allocation tags, budgets and alerts, regular rightsizing and a monthly explanation of the bill.
Apply least-privilege access and keep credentials out of code and configuration.
Design for failure: define what happens when a zone or service is unavailable, and test it.
Support migrations into the cloud and between services, including [EXAMPLE].

What you bring (five items, no more)

Production experience on [CLOUD], including at least one cost surprise or outage you can describe in detail.
Networking depth: private networks, routing, DNS and private connectivity.
Infrastructure as code in a real codebase.
Identity and access management designed for least privilege.
Scripting in [LANGUAGE] for automation.

Nice to have

A second cloud, only if you run one.
Provider certification at associate level or above. It shows an exam was passed, not that the person has been on call.
Experience in [REGULATED INDUSTRY OR COMPLIANCE FRAMEWORK].

Engagement

[CONTRACT, CONTRACT-TO-HIRE OR PERMANENT]. [ONSITE, HYBRID OR REMOTE]. [START DATE AND TERM]. On-call: [YES OR NO, ROTATION].

The AWS, Azure and Google Cloud versions differ in names, not in judgement

Swap the vocabulary, keep the responsibilities. Each provider publishes a framework for judging a cloud design, and a good candidate can talk about whichever one applies to your cloud.

	AWS	Azure	Google Cloud
Account structure	AWS Organizations and accounts	Management groups and subscriptions	Organization, folders and projects
Private networking	VPC, subnets, NAT gateways, endpoints	Virtual network, NAT gateway, private endpoints	VPC network, Cloud NAT, Private Service Connect
Managed messaging	Amazon SQS, Amazon MSK	Azure Service Bus	Pub/Sub
Cost tooling	Cost Explorer and budgets	Microsoft Cost Management	Cloud Billing reports and budgets
Design framework	Six pillars, including sustainability [1]	Five pillars [2]	Six pillars, including security, privacy and compliance [3]

Framework pillar counts from each provider's documentation; service names are the providers' own.

The cloud architect variant changes who decides, not the template

Hire an architect when someone must choose between designs and be accountable for the choice. Keep the engineer template and change these lines.

Replace 'provision and operate' with 'design and review'. The architect specifies; engineers build.
Add design authority. State what the architect can approve, and what needs a committee.
Add framework reviews. Reviews against the provider's well-architected pillars, and a record of the trade-offs accepted.
Add cost modelling. Estimating cost before build, not explaining it after.
Add migration strategy. Sequencing, dependencies and rollback for moves into and between clouds.
Keep one hands-on line. An architect who has stopped building tends to design what they cannot run.

If the real need is an enterprise architect across integration and messaging rather than a cloud architect, that is a different role with its own hire page.

Screening questions mapped to the job description

Each responsibility has one scenario. Listen for the third column. Where a documented behaviour is involved, it is cited.

Responsibility	Question	A senior answer contains
Cost	An AWS bill jumps after a team moves its services into private subnets and nothing else changed. Where do you look?	Cost Explorer by usage type before guessing. A NAT gateway is charged for each hour it is available and each gigabyte it processes [4]. Proposes a gateway endpoint for S3, which needs no internet gateway or NAT device and has no additional charge [5], and checks for new cross-zone traffic.
Account structure	A compromised credential in a development account. How far can it reach?	Answers from the account or subscription boundary: separate accounts per environment, scoped roles, no shared long-lived keys. Can say what limits the blast radius and how they would know.
Infrastructure as code	Two engineers apply the same Terraform change at the same time. What goes wrong and how do you prevent it?	Remote state with locking, changes through a pipeline, plan reviewed before apply, and a policy against console changes.
Identity	A service needs read access to one storage bucket. How do you grant it?	A role or workload identity scoped to that resource, short-lived credentials, no keys in configuration, and an audit trail.
Design for failure	One availability zone becomes unavailable. What happens to your service, and how do you know?	Knows which components are zonal, which are regional, and which single points remain. Has tested a failover rather than assumed it.
Managed services	A queue consumer starts processing messages twice. Why?	Visibility timeouts shorter than processing time, at-least-once delivery, idempotent consumers and dead-letter handling. Fixes the consumer, not only the timeout.

NAT gateway and S3 gateway endpoint behaviour from AWS documentation. Remaining answers are practitioner judgement.

Contract and permanent cloud postings differ in four lines

Access. Say how long cloud account, identity and repository access takes. It comes out of a contract term.
Change authority. State whether the engineer can change production, or only raise changes.
Spend authority. State who approves a new resource that costs money.
Handover. For a contract, name the diagrams, runbooks and code documentation expected at the end.

ConnTal's indicative from-rates for senior contract engineers are $80 an hour for nearshore and offshore delivery and $120 an hour for onshore, depending on platform scarcity, seniority, clearance and term. They are a starting point, not a quote.

If you want a cloud engineer screened against this rubric by a practitioner, send us the role brief and we will say plainly whether we can staff it.