Cloud Engineer

Responsibilities: — Manage AWS infrastructure as code using Terraform within a pull-request-based GitOps workflow, resolving configuration drift across regions. — Utilize AI tools to draft, review, and explain Terraform changes, verifying every plan before merging and owning all approved changes. — Maintain reusable Terraform modules and standards to ensure AI-generated changes are safe and consistent. — Design and operate AI assistants integration with AWS environments for investigation, analysis, incident triage, and infrastructure changes. — Define IAM roles, permission boundaries, logging, and approval gates to govern AI tool access. — Evaluate AI access risks and auditability. — Implement security controls including encryption at rest, TLS in transit, IAM and S3 permissions tightening, WAF rules, security headers, and secret rotation. — Address pentest and audit findings with verified fixes. — Secure AI tooling including agent credentials, secrets handling, MCP server exposure, and prompt injection risks. — Configure and maintain SOC 2 and HIPAA compliance controls such as log retention, alarms, VPC flow logs, and backups. — Ensure AI-assisted changes follow the same review, approval, and audit trails as other changes. — Gather audit evidence and maintain security tooling. — Build monitoring, alerting, and runbooks that are clear for both humans and AI assistants. — Lead OS upgrades, runtime migrations, dependency updates, and certificate renewals. — Operate and scale databases on multiple platforms, tuning, resizing, and securing them. — Provision or decommission dedicated customer servers. — Troubleshoot production issues and automate repetitive tasks using AI and CI/CD improvements. — Participate in a weekly 24/7 on-call rotation responding to production alerts and updating runbooks. Requirements: — 3-5 years of experience in cloud infrastructure, DevOps, SRE, or platform engineering, with at least 2 years in AWS production environments. — Experience shipping infrastructure changes through code review. — Experience operating multi-tenant SaaS platforms at scale and participating in 24/7 on-call rotations. — Deep knowledge of AWS services including EC2, ECS/Fargate, Lambda, VPC, IAM, S3, CloudFront, and RDS. — Strong understanding of Terraform including module design, state management, and CI/CD workflows. — Knowledge of cloud security fundamentals such as least-privilege IAM, encryption, network security groups, WAFs, secrets management, and vulnerability remediation. — Hands-on experience with monitoring, logging tools, and building actionable alerts. — Experience administering relational and NoSQL databases in production. — Solid Linux and Docker container fundamentals. — Ability to read and reason about code/scripts in Python, Go, Bash, Node.js/TypeScript. — Practical daily use of AI tools like Claude with critical review and accountability for AI-generated outputs. Preferred Qualifications: — Experience with compliance frameworks such as SOC 2, HIPAA, FedRAMP, or ISO 27001. — Experience with AWS GovCloud or other regulated environments. — Security certifications like AWS Certified Security - Specialty, CompTIA Security+, or CCSP. — Experience with SIEM, intrusion detection, or threat modeling. — Experience running AI/LLM infrastructure including Amazon Bedrock, LLM gateways, vector databases, or MCP servers. — Experience governing AI agent access to cloud environments. — Familiarity with GitOps tooling for Terraform and CI/CD platforms such as CircleCI, GitHub Actions, or AWS CodeBuild. — Experience with data warehouses and ETL tooling like Redshift. — Kubernetes/EKS experience. — Experience in small or early-stage companies with diverse responsibilities. Additional Information: — The position is full-time remote, either US-based with standard US business hours or international contractors with 4 hours overlap with Eastern timezone. — Weekly 24/7 on-call rotation is required. — Interviews will be recorded and transcribed by AI notetaking tools for evaluation purposes, with opt-out available.