GCP DevOps Engineer: Establish Secure Landing Zone, Billing Hard-Stops & Serverless IAM

We are a Google Cloud Partner seeking an expert GCP DevOps Engineer to build a clean, secure, and cost-controlled Landing Zone framework for an incoming web application client. This is a fixed-price project. All infrastructure must be written as modular, reusable Terraform scripts. You will test and deploy these scripts inside a restricted sandbox environment that we provide. Key Deliverables: 1. IAM Role Isolation: Configure explicit Least-Privilege IAM groups separating "Owner Views" (Billing/Monitoring) from "Developer Views" (restricted access to deploy code). Developers must be strictly blocked from spinning up high-cost or unapproved services. 2. Infrastructure Capping Organization Policies: Restrict Allowed Machine Types for Cloud SQL instances (e.g., max db-custom-1-3840) and disable automated disk storage auto-scaling. 3. Serverless Guardrails: Configure Cloud Functions infrastructure deployment rules to forcefully restrict max-instances to 15 and execution timeouts to 30 seconds. 4. Automated Billing Hard-Stops: Implement a programmatic script via Pub/Sub and a lightweight Cloud Function that detects if budget thresholds (120% of target) are breached, triggering a soft resource cap/billing suspension to protect against run-away code loops. Requirements: • Proven experience with GCP Organization Policies, IAM architecture, Cloud SQL, and Cloud Functions. • Infrastructure as Code expert (Terraform). • Strong documentation habits.