Hanoi, VietnamEngineering
About the Role
You will design, build and operate AWS Landing Zones and migrate enterprise workloads (virtual machines, applications and databases) from on-premises to AWS for banking and financial-services clients.
This is a hybrid role: roughly 50% hands-on delivery and 50% client-facing work as the technical counterpart to the client's infrastructure, security and application teams.
What You Will Do
Hands-on delivery (~50%)
- Build and operate AWS Landing Zones for banking clients: Organizations, OUs, SCPs, Control Tower / LZA, IAM Identity Center integrated with the bank's Active Directory, centralized logging and security tooling (CloudTrail, Config, GuardDuty, Security Hub).
Design hybrid networking: VPC and IP planning (IPAM), Transit Gateway segmentation, centralized egress and traffic inspection, Direct Connect / VPN with redundancy, hybrid DNS (Route 53 Resolver), PrivateLink.
Automate as code: reusable Terraform (or CloudFormation/CDK) modules, CI/CD pipelines, Python/Bash scripting.
Assess on-premises estates (RVTools, AWS Transform for VMware, Migration Hub), map dependencies, apply the 7Rs and plan migration waves, including coexistence while on-premises and AWS run side by side.
Migrate VMs, applications and databases with third-party tools (e.g. Carbonite, Zerto, RiverMeadow, VMware HCX, Veeam, Oracle GoldenGate, Qlik Replicate) and AWS-native services (MGN, DMS, SCT).
Own cutover — runbooks, rehearsals, go/no-go, rollback — then validate workloads, right-size for cost, set up monitoring, backup and DR (RTO/RPO), and hand over to operations.
Client-facing (~50%)
Act as the technical counterpart to the client's infrastructure, network, security and application leads.
Run workshops and present designs and trade-offs to both technical and non-technical stakeholders.
Take designs and cutovers through the bank's security, risk and change-approval (CAB) processes.
Flag risks and limitations early with practical mitigations; keep design docs, runbooks and status reports current.
Support AWS partner programs when applicable (Partner Central, ACE, MAP, MPE tagging).
What We Are Looking For
4+ years in cloud infrastructure, infrastructure migration or VMware administration.
Set up and operated at least one AWS Landing Zone in banking or financial services, including multi-account management.
Strong networking and hybrid cloud skills: TCP/IP, BGP, NAT, firewalls; Transit Gateway, Direct Connect / VPN, hybrid DNS; troubleshooting across on-premises and AWS (Flow Logs, Reachability Analyzer).
Hands-on migration of VMs, applications and databases to AWS using third-party and/or AWS-native tools.
Knows where migrations go wrong: legacy or unsupported platforms, bandwidth and large data sync, live database replication (CDC), licensing (Oracle, SQL Server, Windows), hard-coded IPs and hidden dependencies, tight bank downtime windows.
Infrastructure as code (Terraform preferred) and scripting (Python or Bash).
Proven ownership of cutover, rollback and go/no-go decisions.
Confident working directly with client technical leads; good written and spoken English.
Strong understanding of information security and technology governance, with experience ensuring engineering practices follow company security policies and ISO 27001-aligned procedures.
Nice to Have
Banking compliance: Circular 09/2020/TT-NHNN, PCI DSS, ISO 27001.
Amazon EVS, VMware VCF / HCX; Windows Server, Active Directory, Oracle, SQL Server.
AWS Professional or Specialty certification: Solutions Architect – Professional, Advanced Networking – Specialty or Security – Specialty.
Candidate Data Privacy Notice:
Please note that the personal information provided in your application may be collected, stored, and processed by CoderPush only for recruitment purposes, including reviewing your profile, contacting you during the hiring process, and assessing your suitability for relevant opportunities. If your application is not successful for the current position, we may retain your information for up to 12 months to consider you for future roles that may match your experience. Your data will only be kept for as long as necessary for recruitment purposes or as required by applicable laws and regulations. By submitting your application, you acknowledge that you have read and understood this notice and that the information provided is accurate and complete.