Senior Platform Engineer (Lead)

Senior Platform Engineer (Lead)

AWS landing zone and Kubernetes platform for a HIPAA-regulated public-health data platform Hybrid Salt Lake City Utah

Were looking for a senior platform engineer to build from the first line of code the AWS platform that will carry rural health data and then run it in production. Youll own the landing zone and Kubernetes platform behind the project a cloud-based open-source semantic data model. The project will harmonize EHR claims and public-health data into one computable form and serves it through FHIR APIs.

The platform holds protected health information. It is held to NIST SP 800-53 moderate controls and the HIPAA Security Rule with 99.9% availability a 15-minute RPO a 4-hour RTO and a seven-year tamper-evident audit log. Youll build it alongside a dedicated team and by the end of the term the whole environment must be rebuildable from code and ready to hand to the State.

THE ROLE AT A GLANCE

WHAT YOULL DO

You take the platform from the first OpenTofu module to a production environment with a warm DR standby by spring and youre the person who can rebuild it all from code.

1. Build the AWS Organization as code: separate accounts for management security log archive sandbox test staging and production plus OUs IAM Identity Center with MFA and organization-wide CloudTrail and Config.
2. Design the network: private-only VPCs across three AZs egress inspected through Network Firewall Transit Gateway VPC endpoints and Client VPN. Youll also set the partner connectivity patterns (site-to-site VPN PrivateLink mTLS with a private CA).
3. Run Amazon EKS: private endpoint Bottlerocket nodes with Karpenter pod security standards Cilium network policies upgrades and capacity and cost tuning for Kafka and Spark.
4. Operate the data services: Aurora PostgreSQL (TLS PITR Global Database) MSK S3 zones with Object Lock and cross-region replication ECR Secrets Manager and AWS Backup plus Keycloak Prometheus and OpenTelemetry on the cluster.
5. Own the delivery pipeline: GitHub Actions with OIDC to AWS OpenTofu plan and apply with policy gates Argo CD Helm conventions and Kyverno admission. Shipping should be easy for every engineering team on the program.
6. Keep it running: write the runbooks lead the monthly restore drill and the annual cold-rebuild test take on-call for severity-1 platform incidents (15-minute acknowledgment) and run post-incident reviews.
7. Report and hand over: report monthly on availability capacity and tagged AWS spend. Youll prove portability on open-source equivalents (MinIO Nessie self-managed PostgreSQL) and hand the platform to the States team with documentation they can run it from.
8. Lead: guide a second platform engineer day to day and review the teams infrastructure changes. Youll be able to cover each others on-call.

YOUR FIRST 30 DAYS

The first three weeks are the critical path for the whole program. Youll pair with the Engineering team to stand up the landing zone then hand it to the application teams.

WHAT YOU BRING

1. 7 years in infrastructure or platform engineering including 4 years running production Kubernetes on AWS (EKS strongly preferred).
2. Experience operating a regulated workload (HIPAA FedRAMP PCI) and the ability to explain what the regulation changed about the design in healthcare-specific environments.
3. Deep Terraform or OpenTofu: multi-account organizations modules remote state and policy as code (OPA Checkov or tfsec). Youve built an AWS Organization from zero before.
4. Hands-on with VPC design Transit Gateway Network Firewall PrivateLink IAM Identity Center KMS Aurora PostgreSQL MSK or Kafka S3 Object Lock ECR and AWS Backup.
5. GitOps and CI: Argo CD or Flux Helm GitHub Actions container image signing and SBOMs.
6. Observability: Prometheus and Grafana OpenTelemetry and log shipping to OpenSearch or Elasticsearch.
7. You write clear runbooks and ADRs and youre comfortable leading and reviewing the work of one or two engineers.

NICE TO HAVE

1. Karpenter and Bottlerocket in production; Cilium or Calico network policy.
2. Spark on Kubernetes and Iceberg tables; Strimzi or MSK operations at scale.
3. Keycloak or another OIDC provider; Kyverno or Gatekeeper.
4. AWS Solutions Architect or DevOps Engineer Professional; CKA or CKS.
5. Public-sector or healthcare delivery and experience handing a platform over to a client team.

HOW WE HIRE

This role has production access to protected health information so we verify every candidate carefully. These steps also protect you from recruiting scams that impersonate real employers.

1. Video interviews are live with cameras on. The technical interview is a live session no take home components.
2. Finalists meet the team in person in Salt Lake City before any offer.
3. Before the contract is signed we verify your identity with government-issued photo ID (checked in person) confirm your W-9 taxpayer information with the IRS and verify your U.S. address work history and references.
4. Well never ask you for money equipment purchases or banking details during the hiring process.
5. We only contact candidates from an @ email address. If someone reaches out about this role from any other address please dont respond.