DevOps Engineer (Google Cloud Platform Infrastructure as Code) with Terraform

Role — Terraform / DevOps Engineer (Google Cloud Platform Infrastructure as Code)

Location: Remote

Duration: 12+ months

Engagement: SAS to Google Cloud migration for a US healthcare client Duration: 12 months, front-loaded (environment build in the first 3 months) Environments: Development, QA/UAT, Production

Role summary

You will own the infrastructure for a greenfield Google Cloud Platform data platform. Everything in the environment — storage, datasets, service accounts, permissions, transfer jobs, container services, orchestration and the data governance model — is defined in Terraform and deployed through a CI/CD pipeline. Nothing is created by hand in the console.

You are the first person on the ground. The development team builds into the environment you create, so this role starts on day one and the platform's security model is yours to design and implement.

Must have

10-15 years in infrastructure, platform or DevOps engineering overall.
4+ years provisioning Google Cloud with Terraform. This is Google Cloud Platform-specific. Terraform experience confined to AWS or Azure will not transfer cleanly for this role — the provider, resource model and IAM design are materially different.
Strong Google Cloud Platform IAM. Resource hierarchy, custom roles, service accounts, workload identity federation, least-privilege design. A significant part of this role is deciding who and what can access data, and proving it.
Terraform at production standard. Modules, remote state with locking, workspaces or per-environment variable files, plan gating, drift detection, import of existing resources, and provider version pinning.
CI/CD for infrastructure. Building and maintaining a pipeline that runs plan and apply across three environments with approval gates. Tool-agnostic, but you must have built the pipeline, not just consumed one.
Hands-on with these Google Cloud Platform services as Terraform resources: Cloud Storage (lifecycle rules, uniform bucket-level access, object versioning, CMEK), BigQuery (datasets, table schemas, authorised views), Cloud Run, Artifact Registry, Cloud Scheduler, Workflows, Secret Manager, Cloud KMS, Pub/Sub, Cloud Logging and Monitoring (sinks and alert policies).
Networking for private connectivity. VPC, Private Service Connect, Serverless VPC Access connectors, firewall rules, and connecting Cloud Run or managed services to on-premise systems over an existing interconnect.
Working with a client platform team. Much of the first six weeks is raising and chasing organisation policy exceptions, project provisioning and IAM escalations. You need to be comfortable driving that, not waiting on it.
Client-facing communication. These roles sit with the client team daily and are expected to explain design decisions, run working sessions and represent the solution in architecture and security reviews. Written and spoken clarity matters as much as technical depth.
Seniority to set the standard, not just follow one. At this level you are expected to define the module structure, naming and promotion conventions the rest of the team works to, review their infrastructure changes, and represent the design in client architecture and security reviews

Strongly preferred:

BigQuery data governance in Terraform — Dataplex / Data Catalog taxonomies, policy tags, and data policies for column-level security and dynamic data masking. This is a core deliverable on this engagement and genuinely differentiating; most candidates have not done it.
Storage Transfer Service configured as code, including agent-based on-premise transfers.
Dataform repositories, release configurations and workflow configurations managed through Terraform.
Experience in a regulated environment — healthcare, financial services or similar — where access control has to be evidenced and audited.
Python or Go for tooling and automation.
Container build pipelines (Cloud Build or equivalent) pushing to Artifact Registry.
Experience consuming a client's existing shared Terraform module library and working within their conventions rather than writing from scratch.

What you will deliver
Three environments — development, QA and production — from a single Terraform codebase with per-environment variables. No hand-built resources, no environment drift.
The complete data governance model as code: taxonomy, policy tags, masking rules and the IAM bindings that make them work, with every change traceable to a reviewed commit.
A CI/CD pipeline with plan output on pull request and gated apply to each environment.
Private connectivity from Google Cloud Platform services to on-premise source systems.
Documentation and handover sufficient for the data engineering team to make their own routine infrastructure changes under your review, rather than queuing behind you.
Screening notes for the recruiter

Candidates frequently list Terraform alongside a dozen other tools. For this role, Terraform on Google Cloud Platform must be the primary skill and DevOps the secondary — not the other way round. A candidate whose Terraform experience is provisioning virtual machines and storage buckets is not sufficient; this platform is built around BigQuery, IAM and data governance.

Thanks & Regards