DevOps Engineer

Our company is a start-up that specializes in episodes of care benefit plans. We have a deep expertise in episode pricing and analytics and our goal is to bring transparency and efficiency to the healthcare market. Our company is committed to providing high-quality, affordable healthcare to our customers.

• →Build and maintain our IaC estate: We run a fleet of TypeScript AWS CDK repos (one per platform: message bus, SFTP exchange, OpenSearch, org policies, and more) deploying via CodePipeline into a dozen+ accounts. You'll extend existing stacks, split monoliths apart cleanly, and bootstrap new accounts into the pattern.
• →Own production services: ECS Fargate behind ALBs, Aurora, Lambda, API Gateway, S3, AWS Transfer Family for partner SFTP, OpenSearch, DMS replication. Deploy, monitor, right-size, and debug them.
• →Make observability actually catch things: CloudWatch alarms, Synthetics canaries, VPC flow logs, CloudTrail, log retention and redaction policies. We care about the difference between an alarm that exists and an alarm that pages someone.
• →Automate security and compliance: Service Control Policies as guardrails, IAM Identity Center permission sets, Prowler-driven evidence collection into WORM storage for SOC 2, secret scanning and SAST in PR pipelines. You'll help move controls from "reviewed quarterly" to "enforced continuously."
• →Run access management as a product: Okta SSO/SAML, SCIM provisioning, our OpenVPN Access Server fleet, and the approval-gated automation that provisions VPN and AWS access from a Jira ticket or a chat command.
• →Build internal tooling: A lot of our ops surface is chat-native: Google Chat bots and webhooks that review PRs, report compliance drift, page on-call, and provision access. Several are LLM-backed on Amazon Bedrock. You'll ship these, not just consume them.
• →Improve CI/CD: GitHub Actions workflows, PR gates, org rulesets, auto-merge policy, deployment safety (changeset previews before anything touches prod).
• →On-call rotation: Participate in on-call for production infrastructure.

• 4+ years in DevOps, SRE, platform, or cloud infrastructure engineering.
• Deep, hands-on AWS: You can reason about IAM trust policies, VPC networking, and cross-account access without a diagram.
• Real Infrastructure-as-Code experience: AWS CDK strongly preferred; Terraform/CloudFormation background transfers fine, but you'll be writing TypeScript CDK here.
• Production Coding: Comfortable writing production code, not just config (TypeScript and/or Python).
• CI/CD Pipeline Ownership: GitHub Actions, CodePipeline, or equivalent.
• Containers on AWS: ECS or EKS, image builds, ECR, task/service configuration.
• Linux Administration: Shell fluency; comfortable on a box with systemctl, journalctl, and no GUI.
• Identity Systems: SSO/SAML/OIDC, IAM roles vs. users, least privilege in practice.
• Clear Written Communication: Our runbooks, PR descriptions, and incident notes are how the team scales.

• Healthcare, fintech, or another regulated environment; HIPAA or SOC 2 audit experience.
• AWS Organizations at scale: SCPs, Control Tower, Identity Center, multi-account CDK bootstrapping.
• Data platform exposure: Glue, Athena, QuickSight, Lake Formation, DMS.
• Amazon Bedrock or other LLM API work—we build with Claude and are actively expanding internal AI tooling.
• Windows Server administration via SSM (a slice of our analytics estate is Windows).
• OpenVPN Access Server, Cloudflare, Route 53 at an operational level.
• Next.js / React—several internal dashboards are full-stack and you'd own them soup to nuts.