Databricks Architect (AWS)

We have an opening for Databricks Architect (AWS) with Remote. Kindly apply with your updated resume if you are interested. Please find the job details below:

Position: Databricks Architect (AWS)

Location: Remote

Duration: 12 Months Contract

Key Responsibilities

• Strong understanding of Databricks classic and serverless workspace deployments on AWS, including S3, IAM, VPC design, and both front-end and back-end PrivateLink connectivity
• Hands-on Terraform experience across both AWS and Databricks resources to deploy, configure, and manage secure workspace infrastructure
• Working knowledge of Databricks platform security architecture, including workspace isolation, identity integration, cluster access controls, secret management, and network security patterns
• Strong communication skills with ability to independently lead architecture enablement sessions with large customer teams
• Preferred: prior experience taking customer teams through Databricks security accreditation process
• Deep understanding of multi-workspace topologies hub-and-spoke VPC designs, Transit Gateway integration, shared services VPCs, and cross-account network connectivity patterns for environment isolation (dev/staging/prod)
• Knowledge of data exfiltration prevention architectures S3 VPC endpoint policies, restrictive bucket policies, STS condition keys, regional restrictions, and how Databricks data plane traffic flows interact with these controls
• Expertise in AWS PrivateLink at scale including endpoint services, interface endpoints, DNS resolution chains (Route 53 Private Hosted Zones, inbound/outbound resolvers), and troubleshooting connectivity failures across complex multi-account Landing Zone architectures
• Deep knowledge of IAM trust chains in Databricks deployments cross-account assume-role patterns, instance profiles vs. credential passthrough, IAM Roles for Service Accounts (IRSA) where applicable, and the Databricks-managed IAM role boundary model
• Understanding of credential vending and Unity Catalog's storage credential architecture how temporary credentials are scoped, session policies, external location grants, and how these map to S3 access patterns auditable by CloudTrail
• Expertise in encryption architecture CMK (Customer Managed Keys) for workspace storage, DBFS root, managed services (notebook/secret encryption), EBS encryption, and S3 SSE-KMS with key policies restricting decrypt to specific principals; understanding of key rotation implications