Developer, DevOps engineer, architect. Three hires, one job advert.
The word “AWS” in a job title covers people who build on it, people who run it, and people who design it. They are different, they cost differently, and the advert almost never says which.
Which of the three do you need?
Most briefs describe one and need another. This is the first thing we establish, and it changes the rate as well as the person.
Cloud developer
Builds applications that happen to run on AWS. Lambda, containers, queues, managed databases. If the deliverable is a feature, this is your hire, and often your existing backend engineers can do it.
Lambda ECS SQS RDSDevOps / platform engineer
Builds and runs the platform others deploy onto. Pipelines, infrastructure as code, observability, incident response. If the deliverable is that other engineers can ship safely, this is the hire.
Terraform CI/CD Kubernetes ObservabilityCloud architect
Designs the account structure, networking, identity, security boundaries and cost model. Usually needed for weeks at the start and a few days a month afterwards, not permanently.
Landing zones Networking IAM CostWhat we ask a cloud engineer.
Weighted heavily towards operating things rather than provisioning them, because provisioning is the part a certification actually covers.
Describe an incident you were on call for.
What broke, how it was found, what changed afterwards. The single most informative question in this category.
How is your infrastructure defined?
Terraform, CDK, CloudFormation, and crucially whether anything is clicked in the console. Honesty here is a good sign.
What does this cost, and how do you know?
Tagging, budgets, and a story about something that was reduced. Cost is where cloud engagements are judged after year one.
How do you handle secrets?
Parameter Store, Secrets Manager, rotation. A vague answer usually means credentials in environment variables somewhere.
Do you need Kubernetes here?
Often the answer is no, and a candidate who says so unprompted has judgement, not enthusiasm.
What is your blast radius?
Account separation, IAM boundaries, what a compromised pipeline could reach. Architects answer this immediately.
What your brief probably needs.
The left column is roughly how these arrive. The right is what we would staff.
| What the brief says | What it needs | Note |
|---|---|---|
| Build serverless features | Cloud developer | Your existing backend engineers may already cover this |
| Deployments are slow and manual | DevOps engineer | Pipelines and IaC |
| We keep having outages | DevOps engineer | Observability first, then architecture |
| Our bill is out of control | Architect, briefly | Usually days of work, not a hire |
| We are moving to the cloud | Architect, then DevOps | In that order — see cloud migration |
| We need Kubernetes | Worth challenging first | Often ECS or Container Apps is enough and far cheaper to run |
| Security review flagged our cloud | Architect | IAM, network boundaries, logging |
Azure and Google Cloud, equally.
This page is called AWS because that is what people search for. Our cloud engineers work across all three, and a good number of our clients are on Azure because they were already on Microsoft.
Azure
App Service, Functions, Container Apps, AKS, Azure SQL, Entra ID and Bicep. The default where the organisation is already Microsoft, and usually the cheaper path there.
Google Cloud
GKE, Cloud Run, BigQuery and Vertex AI. Most often chosen for data and ML work, not as a general platform.
More than one at once
Common and rarely deliberate, an acquisition, or a data platform somewhere else. Worth a design decision, not drift.
Portability
Genuine multi-cloud portability costs more than it returns for most organisations. We would rather make the lock-in explicit and priced.
On-premises still in the picture
Hybrid is the normal state for enterprises, not a transitional one. Networking and identity across the boundary is the actual work.
Which one for a new platform
Whichever your team can operate. The technical differences matter far less than the operational familiarity.
Rates, notice and how we interview, on one page.
The commercial mechanics are the same whichever role you are hiring, so they live in one place, not being restated on every page.
Hiring cloud engineers.
Including what certifications are and are not worth.
Are AWS certifications worth anything?
As a signal of breadth, yes, a certified engineer has been exposed to services they have not used, which makes them likelier to know that an option exists. As a signal of capability, very little, because the exams test recall of service features rather than judgement under pressure. The question that separates candidates is what happened during an incident: what broke, how they found it, what they changed afterwards. Nobody can revise for that. We treat certifications as a tiebreaker and the incident question as the interview.
Do we need a full-time DevOps engineer?
Probably not at first, and this is one of the most common over-hires we see. The platform work has a shape: a concentrated burst to set up pipelines, infrastructure as code, environments and observability, then a much smaller ongoing load of maintenance and improvement. Hiring full time for the burst leaves you with an expensive engineer looking for work, and the usual result is unnecessary complexity built because somebody had capacity. We would staff it heavily for the first months and then reduce to a few days a month, with your application engineers owning their own deployments, which is where you want to end up anyway.
How do we get our cloud bill under control?
It is usually days of work rather than a hire, and it is usually the same handful of things: over-provisioned instances sized for a peak that never arrives, non-production environments running overnight and at weekends, storage with no lifecycle policy, forgotten load balancers and NAT gateways, and no tagging so nobody can attribute anything to a team. An engineer who has done this before will find most of it in a week and the savings are typically substantial and immediate. What takes longer is the governance that stops it coming back, which is a tagging standard, budgets with alerts and someone owning the number.