Cloud Platform Engineer

Responsibilities: We're hiring AWS Cloud Platform Engineers to build and own the platform's foundation. That means the AWS accounts, networking, identity and infrastructure-as-code everything runs on, plus the path from commit to running agentEach engineer will have a main focus in one of the two areas below and work closely across both. This is a named-team engagement, so the person we propose is the person who startsInfrastructure & IaC: Build and own the base AWS layer: accounts, networking, identity boundaries, and the reusable IaC modules the rest of the platform is built fromCI/CD & Runtime Deployment: Own the path from commit to running agent: container builds, Amazon ECR, pipelines, environment promotion, and AgentCore Runtime session configurationAccount and Environment Foundation: Design and stand up the multi-account AWS structure (Organizations, Control Tower or equivalent) with guardrails and service control policiesNetworking: Build secure VPC designs and private connectivity (VPC endpoints, PrivateLink, Transit Gateway) so agent workloads can reach internal systems safelyIdentity Boundaries: Define IAM roles, permission boundaries and least-privilege access for platform services, pipelines and consuming teamsReusable IaC Modules: Build and maintain versioned Terraform and/or AWS CDK modules other teams can use with confidenceBuild Pipelines: Design and own CI/CD pipelines that build, test, scan and publish agent containers to Amazon ECREnvironment Promotion: Automate promotion from dev to test to production with approval gates, rollback and version trackingRuntime Deployment: Configure and deploy agents to AgentCore Runtime, including session settings, scaling, config and secrets handlingGolden Path Templates: Build starter repos and pipeline templates so every new agent is set up and shipped the same waySecurity and Compliance: Build encryption, logging, tagging, image scanning and audit requirements in from the start, working with client security teamsDocumentation and Enablement: Write module docs, decision records and runbooks so the platform doesn't depend on any one personQualificationsClear communication and comfortable working in a blended client and vendor teamSolid AWS networking knowledge: VPC design, routing, VPC endpoints, PrivateLink, Transit Gateway and DNSStrong infrastructure-as-code skills with Terraform and/or AWS CDK/CloudFormation, including writing reusable modulesExperience with secrets and config management (AWS Secrets Manager, Parameter Store)6+ years of cloud, platform or DevOps engineering experience, with at least 4 years hands-on building production AWS environmentsHands-on experience building CI/CD pipelines (GitHub Actions, GitLab CI, AWS CodePipeline/CodeBuild or similar) Strong container skills: Docker, Amazon ECR, and deploying to ECS, EKS, Fargate or LambdaDeep hands-on strength in at least one of the two focus areas, and working knowledge of the otherDeep understanding of AWS IAM, including cross-account access, permission boundaries and service control policiesYou have prior experience in consultingExperience in pharma, life sciences or another regulated industry with strict security and change control requirementsYou work well inside a client team and build trust quicklyYou default to secure, least-privilege designs and can explain whyPrior experience and connections in the Life Sciences industry is preferredExperience with policy-as-code and supply chain security tools (e.g., OPA, Checkov, cosign, SBOM tooling, Amazon Inspector)AWS certifications such as Solutions Architect Professional, DevOps Engineer Professional or Advanced NetworkingYou think in reusable building blocks and care about the engineers who use them after youYou write things down so decisions don't live only in your headYou automate anything you have to do twiceExperience with Amazon Bedrock, AgentCore Runtime, or deploying LLM/agent-based applications