Senior Systems Engineer

The Senior Systems Engineer builds and operates the AWS GovCloud infrastructure hosting the Project Argos pipeline, which includes containerized ingestion, validation, endpoint observation, and evidence-assembly services in Broadway’s contractor-owned GovCloud tenancy. This role involves ownership of infrastructure as code, CI/CD, monitoring, and tamper-evident evidence storage, producing technical control evidence for the project’s Authority to Operate (ATO).

Works with:

Technical Lead, Application Developer, and the project security lead.

Key Responsibilities:

• Build and maintain the GovCloud environment (ECS/Fargate, DynamoDB, S3, VPC, IAM, CloudWatch) using Terraform or equivalent infrastructure as code, adhering to secure deployment patterns for government hosting and security requirements.
• Design and implement a CI/CD pipeline for container image build, vulnerability scanning, and deployment, ensuring release versioning to trace code, model, prompt, rule, and source versions.
• Implement immutable or tamper-evident storage and logging for data ingestion, agent decisions, human review, evidence packaging, and release versions, including S3 Object Lock or equivalent controls.
• Configure and manage outbound traffic to maintain configurable endpoint observation cadence while respecting source rate limits across 290 certified health IT products.
• Set up monitoring, alerting, and incident response for production services, meeting the contract requirement to report suspected or confirmed security incidents within one hour.
• Manage secrets, TLS/PKI, DNS, and network segmentation for the pipeline and its connections to CHPL, Lantern, and developer-published endpoints.
• Write control implementation narratives and supply technical evidence for the System Security Plan and independent security assessment, collaborating with the project security lead.
• Plan capacity and autoscaling to meet contract targets of at least 95% coverage of applicable CHPL listings and 95% evidence completeness.
• Keep architecture, runbooks, and configuration documentation current for knowledge transfer.

Required Qualifications:

• AWS expertise in ECS/Fargate, DynamoDB, S3, VPC networking, IAM, CloudWatch
• Infrastructure as code using Terraform or equivalent
• CI/CD pipeline design and experience with container image build, scanning, and deployment
• Operating containerized services in production
• Monitoring, alerting, and incident response
• Networking fundamentals, including TLS/PKI, DNS, HTTP, and troubleshooting
• Security controls in regulated or federal environments (NIST 800-53 or similar)
• Technical documentation skills
• Ability to obtain U.S. Public Trust clearance

Preferred Qualifications:

• Active Public Trust or Secret clearance
• ATO or third-party security assessment experience
• Capacity planning and autoscaling
• Monitoring or outbound traffic management at scale
• Secrets management and S3 Object Lock or immutable storage
• Familiarity with HL7 FHIR, SMART on FHIR, or ONC certification programs
• AWS professional-level certification