Senior Cloud FinOps Engineer

Job SummaryThe Senior Cloud FinOps Engineer owns CNTXT's financial exposure as a Google Cloud reseller, where CNTXT carries the bill for customer consumption while the controls sit inside customer workloads. The role builds and operates the billing-data platform that reduces consumption visibility from up to 72 hours (with full visibility only at month-end invoicing) to hours, and runs the control process on top of it: daily consumption monitoring, compromised-account response, enforcement under an agreed runbook, and Google-facing claims. The function follows standard centralized FinOps practice and forms the control layer CNTXT will reuse as it expands to multi-cloud.ScopeCovers all CNTXT Google Cloud billing IDs, online and offline, across the reseller customer base, and extends to additional clouds as CNTXT expands multi-cloud.Individual contributor; provides functional guidance to the Billing Operations Analyst on the daily watch and builds the case for Phase 2 hires.Executes enforcement actions (alert, cap, suspension, reactivation) within agreed mandates and the runbook's authority ladder, with approval steps for actions beyond mandate.Owns the tooling roadmap and budget for the function.Reports exposure, incidents and recoveries to the EMT monthly.Principal ContactsBilling Operations Analyst (daily): guide the daily consumption watch and case triage.Finance (regular): align on reconciliation, exposure reporting and collections.Cybersecurity / GRC (regular): align on policy, risk appetite, Security Command Center adoption and the onboarding due-diligence gate.Sales and Customer Success (regular): coordinate customer communication on incidents and enforcement.Legal (occasional): advise on cap clauses in customer terms and back-to-back liability in partner agreements.EMT (monthly): report exposure, incidents and recoveries.Google partner and abuse teams (per incident): negotiate credit claims, handle abuse reports and escalate alerting issues.Customers (per incident): issue notices and coordinate containment and recovery.Principal Duties & Detailed Job DescriptionBilling Data Platform & Visibility (25%): Build and operate the billing-data pipelines and dashboards that give near-real-time consumption visibility across all billing IDs.Anomaly Detection & Monitoring (20%): Implement and tune anomaly detection against per-customer baselines, with alerting into the case workflow and documented triage SLAs.Incident & Enforcement Management (25%): Own the compromised-accounts process and the enforcement runbook end to end, from detection to post-incident review.Google Claims & Partner Handling (15%): Manage abuse reports, credit claims and escalations with Google, backed by complete evidence packs.Governance, Reporting & Function Development (15%): Report to the EMT, provide contract and policy inputs, and develop the function toward multi-cloud and Phase 2.Detailed Job DescriptionBilling Data Platform & Visibility: Build and operate billing-data pipelines (Cloud Billing export to BigQuery) across all billing IDs, online and offline. Design the consumption data model, including per-customer baselines, seasonality and credit-consumption visibility (accounts consuming Google credits invoice at zero and must not read as inactive). Build per-customer and per-margin dashboards for the daily watch, and own data quality on the billing-ID inventory.Anomaly Detection & Monitoring: Instrument detection for compromise patterns such as sudden multi-x spend, GPU and compute bursts, and unusual regions or services. Integrate Google-side signals (abuse notifications, Security Command Center findings) into one case queue with the threshold alerts. Review and tune thresholds monthly.Incident & Enforcement Management: Own the compromised-accounts process: detection, verification, containment, notices, recovery and post-incident review. Chair incident handling for suspected compromises, decide containment steps per the runbook, and own communication timelines to customers and Google. Own the enforcement runbook and its authority ladder, and automate the graduated actions (alert, cap, suspension, reactivation) with approval steps.Google Claims & Partner Handling: Build the credit-claim discipline and its evidence-pack tooling: consumption snapshots, timelines, notification logs, claim windows (30 days for cryptomining program cases), first-incident exception requests and outcome tracking. Handle abuse reports and alerting escalations with Google. Drive Security Command Center Premium adoption for top-exposure customers with Cybersecurity.Governance, Reporting & Function Development: Report exposure, incidents and recoveries to the EMT monthly. Provide contract inputs to Legal on enforceable cap clauses and back-to-back liability, and design the onboarding due-diligence gate with GRC. Work with Finance on reconciliation, exposure reporting and collections. Prepare the multi-cloud extension of monitoring and process, own the tooling roadmap and budget, guide the Billing Operations Analyst, and document everything for Phase 2 hires.Qualification RequirementsEducation RequirementsBachelor's degree in Computer Science, Information Systems, Engineering, Finance or a related field. Equivalent specialized experience may be considered.Work Experience6+ years across cloud operations, FinOps engineering, revenue assurance or fraud operations, with a hands-on build record. Track record of running incident or case processes with defined SLAs and executive reporting. Team or function leadership is a plus; hyperscaler partner ecosystem experience (Microsoft CSP or AWS Solution Provider) is a strong plus.Certification/LicensePreferred: FinOps Certified Practitioner.Language SkillsEnglish: fluent, with executive-level communication. Arabic: strongly preferred.Functional Job CompetenciesGoogle Cloud Billing & Reseller Model: Deep understanding of Partner Sales, billing subaccounts, budgets and caps, and billing export.Billing Data Engineering: Strong SQL and BigQuery and solid Python to build pipelines, models and dashboards; Terraform (infrastructure as code) is a plus.Anomaly Detection & Cloud Security Signals: Ability to baseline consumption and detect compromise patterns; knowledge of Security Command Center and cryptomining detection is a plus.Incident & Case Management: Ability to run runbook-driven incident and case processes with defined SLAs and clear escalation.Financial & Commercial Acumen: Understanding of reconciliation, exposure, credit claims and contract terms, with the ability to report clearly to executives.