A Principal Cloud Engineer
My primary technical partner: roughly 2 to 3 hours per week. They provision access, answer environment questions, and sanity-check findings before they go upstairs.
THE ENGAGEMENT
Working
With Me
What I need from you to deliver results quickly.
An engagement moves as fast as its first two weeks. This page is everything that makes those weeks count: the people I need, the access to request, and what I commit to in return. Hand the technical section to your cloud engineer and the rest to whoever owns the budget.
01
Three people
Committed by name before kickoff. Engagements stall without all three.
ENGINEERING
FINANCE
A Finance Contact Who Knows How Money Moves
Owns budgets, invoices, and vendor agreements, and can walk me through how each team's cloud usage is charged back today, or say plainly that it isn't.
LEADERSHIP
An Executive Sponsor
Someone who will act on recommendations and back the changes. Cost accountability is a leadership behavior before it's a dashboard.
02
Access & identity
Read-only access to billing and usage data, provisioned by kickoff. I never request write access to your environment. If your organization provisions access through Active Directory or Entra ID groups and a ticketing system such as ServiceNow, submit those requests when the contract is signed, not at kickoff; approvals routinely take one to two weeks.
- An account or guest identity for me, with the security groups that grant the billing access below
- Any VPN, MFA, or conditional-access exceptions my access needs
- The request queue or assignment group my tickets route to, plus an approver who knows I'm coming
- Worth knowing: your AD group structure is often the best source for the org hierarchy below; one export serves both access and chargeback
Delays in provisioning access do not pause the engagement clock. The fastest path to value is having this ready on day one.
03
Week-one artifacts
- Your current tagging policy and coverage data
- An inventory of commitments: Reserved Instances, Savings Plans, discount agreements
- Existing budgets and forecasts
- Your chargeback model as it exists today: how finance bills cloud usage back to each internal team, including the allocation identifiers you use (cost centers, WBS elements, project codes) and where they live. If shared subscriptions make this impossible today, say so; finding that out in week one instead of month three is the point.
- An organizational hierarchy: which people belong to which teams, which subscriptions or accounts each team works under, and which department or cost code each team charges back to. This map is what turns billing data into accountability; without it, no tagging cleanup or chargeback model can be defended.
04
What I commit to
SECURITY
Read-Only, Least Privilege
I will never ask for write access to your environment. Scope everything to exactly what's listed; if your security team wants to narrow further, we right-size it together.
CLARITY
A Written Work Plan
You'll always know what I'm doing, why, and what comes next.
RHYTHM
Weekly Status, One-Hour Meeting Cap
A weekly written status: done, found, next, blocked. Meetings capped at one hour per day, because your results come from analysis and building, not conference rooms.
05
How I work
Fully remote. I use modern AI-assisted development and analysis tooling under commercial agreements that prohibit training on customer data. Client billing and usage data may be processed through these tools to accelerate analysis; credentials, secrets, and personal data never are. If your organization has an AI usage policy, share it during onboarding and I'll work within it.
06
Technical appendix
Hand this to your cloud engineer. Access is read-only and least-privilege by design on every platform.
AWS
Cross-account IAM role with:
AWSBillingReadOnlyAccess
ViewOnlyAccess
ComputeOptimizerReadOnlyAccess
CloudWatchReadOnlyAccess
Cost Explorer enabled; "Activate IAM access" on in the Billing console; CUR 2.0 / Data Exports configured in the payer account, delivered to S3
Azure
Cost Management Reader at the agreed management-group or subscription scope
Access to Azure Advisor recommendations
GCP
Billing Account Viewer on the billing account
Project Viewer and Recommender Viewer on in-scope projects
BigQuery billing export enabled, with read access to the export dataset
07