At CI&T, we help large enterprises transform the potential of AI into real business impact with AI Deployment, AI-native execution, and tech-integrated business solutions.

With 30 years of experience in technological transformation, we accelerate innovation with expertise in Agentic SDLC, Application modernization, Data & AI, Martech and Business strategy.

We are 8,000 CI&Ters across more than 25 countries, collaborating to build solutions with real impact. AI is already part of how we work, evolve, and innovate every day.

You will co-own a multi-account AWS network foundation: hub and spoke on Transit Gateway, centralised inspection, controlled egress, hybrid connectivity into a client's SD-WAN estate through a third-party vendor. You will be in the room when the client's cloud architect asks why a subnet is a /25 and not a /24 — and the answer has to be yours.

The work is unglamorous in the way that matters. Most of what goes wrong in a landing zone does not go wrong in a module — it goes wrong at the seams. We want someone who has been burned by those and now checks for them by reflex.

Responsabilidades:

• Own the network foundation end to end: Transit Gateway with separated inspected and uninspected route tables, VPC design across inspection, egress, ingress, shared services, and workload tiers
• Define and enforce the routing posture that makes traffic pass a firewall rather than merely sit near one
• Verify that posture by test, not by reading your own plan
• Design and implement Transit Gateway Connect over GRE with BGP, two peers for availability, ASNs agreed in advance
• Extract precise inputs from third-party SD-WAN vendors who are not on your team and do not share your deadline
• Manage AWS IPAM with a delegated organisation administrator, pool hierarchy mapped to accounts, RAM shares to spoke accounts
• Justify every prefix — "it looked tidy" is not an answer
• Implement AWS Network Firewall with stateful rule groups, default drop posture, domain allowlisting, and managed threat signatures
• Be the person who knows whether an application failing to reach the internet is the firewall working correctly
• Write and maintain Terraform across multiple accounts with per-phase state separation, deployed through GitHub OIDC
• Implement drift detection, static validation, and a pipeline that a client can inherit
• Manage log delivery into governance accounts, resource policies, KMS key policies, and service-linked roles
• Understand that these accept broken configurations silently — and prove delivery by watching a log arrive
• Write down why: why a prefix is what it is, why an option was rejected, what a deviation is
• Prevent the next engineer from reversing a deliberate choice because nobody recorded the reasoning
• Write down why: why a prefix is what it is, why an option was rejected, what a deviation is
• Prevent the next engineer from reversing a deliberate choice because nobody recorded the reasoning