Cloud Engineer

Nobody can explain
the cloud bill.
That is the actual problem.

An unreadable bill is a symptom: no tagging, no ownership, no architecture review. Our cloud engineers fix the cause and the invoice at once — full-time in your team, on the Virtus payroll.

Get a shortlistCloud as a project
One client, one quarter
$98,600→$55,300

$43,300 a month, 44% down

No workloads were switched off and nothing was moved to another provider. The teardown is below, line by line.

The teardown

Seven lines, and what was actually behind each

Every line here was found by reading the bill with the architecture diagram open beside it. None of it needed a tool you do not already have.

Line itemWasNowWhat it was
Compute — on-demand instances$41,200$24,100Two-thirds of the fleet ran at under 12% CPU for a year. Right-sized, then committed to a savings plan for the stable base.
Managed database$18,600$15,400Right-sized and moved to reserved capacity. The multi-AZ replica in the dev account was the surprise.
Storage$9,800$3,900Eleven terabytes of build artefacts with no lifecycle policy, plus snapshots of instances deleted in 2022.
Data transfer$12,400$4,600Cross-AZ chatter between two services that should have been co-located, and an internal API going out through the NAT gateway.
Load balancers & NAT$5,100$2,200Nine load balancers for four services. Four NAT gateways where one per AZ was enough.
Observability & logging$7,300$5,100Debug-level logs retained for 400 days. Sampled, tiered, and the retention agreed with the people who actually query them.
Idle & orphaned$4,200$0Unattached volumes, unused elastic IPs, two whole environments belonging to a project that shipped last spring.
Monthly total$98,600$55,300Payback on one senior engineer: under three weeks.
Beyond the invoice

Cost is the symptom people notice first

The same missing structure that makes a bill unreadable is what makes an audit painful and a migration slip. These six are the actual job.

Landing zones and guardrails

Accounts, org units, SCPs and a tagging policy that is enforced at creation rather than audited afterwards. Cost attribution is impossible without it.

Identity done properly

Federated SSO, no long-lived access keys, and roles scoped to a job rather than to a team's convenience.

Migration with a rollback

Lift, then shift, then optimise — with a documented way back at every step, because the ones without it become the ones nobody finishes.

Networking that survives growth

Address space planned for the company you will be, private endpoints, and egress that is deliberate rather than incidental.

Resilience you have tested

Multi-AZ where it earns its cost, backups restored on a schedule, and a DR plan someone has actually rehearsed.

Compliance evidence

Config rules, CloudTrail or Azure Monitor retention, and controls mapped to the framework your auditor uses.

Seniority

Three bands, 7–12 days to start

AWS and Azure both, with a named primary. Certifications are a filter, not a qualification — we interview on an architecture you have to defend.

Mid-level

3–5 yrs$38–46/hr

Builds and maintains infrastructure to an agreed architecture. Comfortable with the console and Terraform.

Senior

5–8 yrs$46–58/hr

Owns the architecture for an environment. Runs the migration, sets the guardrails, and produces the teardown above.

Architect

8+ yrs$58–80/hr

Designs the landing zone and the multi-account strategy, and is the person your auditors and your CFO both want to speak to.

Send us last month's cost export

We will produce your version of the teardown above within a week, at no charge. If there is nothing to find, we will tell you that too.

Request a shortlistDevOps / SRE instead