Infrastructure Engineer (AWS) for Data Platform

About the role

We are building a new data platform, and it needs to run somewhere — safely, repeatably, and in a regulated environment.

This is the infrastructure seat on a small data platform team. You will own the AWS footprint, the deployment path, and the access model that lets a data pipeline read from production systems safely. We hold a high bar here — declarative, version-controlled infrastructure and tightly scoped production access — and you will be designing within that model from day one.

Why this role, specifically

Plenty of platform roles are about keeping existing infrastructure running. This one is about building the path that lets a new platform touch production data at all — in an environment with protected health information, multiple tenants, and systems clinicians rely on overnight.

That constraint is the interesting part. "Give the pipeline database access" is easy anywhere without rules. Doing it with least-privilege credentials, a fully auditable deployment path, and no manual escape hatches is an actual engineering problem, and it is the one you would own.

You will also be doing it at the start, when the decisions are still open — rather than inheriting someone’s access model and being asked to defend it.

What you will do

• Own the AWS infrastructure for the data platform, defined as code
• Build and maintain the deployment path, using GitOps and continuous delivery
• Design least-privilege access to production data sources — credentials, network routes, and permissions that hold up to scrutiny
• Stand up observability for the platform so reliability is built in rather than added later
• Administer the Kubernetes workloads the platform runs on
• Partner with our security team, which matters here given protected health information and multiple tenants
• Automate the operational work rather than performing it by hand

What you bring

Depth in AWS is the core requirement for this role:

• Networking — VPC design, cross-region and cross-account data movement, private connectivity, VPN
• IAM — able to design least-privilege access, not only apply an existing policy
• Databases — RDS, Aurora, SQL Server, including read replicas
• Storage — S3, including access patterns and bucket policy

Alongside that:

• Terraform or CDK to a production standard
• Kubernetes administration, and GitOps delivery with Argo CD or similar
• Ownership of CI/CD pipelines
• A preference for automation over manual intervention, including autoscaling and self-healing rather than hands-on fixes

Nice to have

• Cloud data warehouse platform administration
• Database replication, particularly SQL Server
• Managed message infrastructure (RabbitMQ, Amazon MQ)
• Healthcare or another regulated, audited environment