Senior Platform Engineer (Lead)

Senior Platform Engineer (Lead)

AWS landing zone and Kubernetes platform for a HIPAA-regulated public-health data platform · Hybrid, Salt Lake City, Utah

We're looking for a senior platform engineer to build, from the first line of code, the AWS platform that will carry rural health data, and then run it in production. You'll own the landing zone and Kubernetes platform behind the project, a cloud-based, open-source semantic data model. The project will harmonize EHR, claims and public-health data into one computable form and serves it through FHIR APIs.

The platform holds protected health information. It is held to NIST SP 800-53 moderate controls and the HIPAA Security Rule, with 99.9% availability, a 15-minute RPO, a 4-hour RTO and a seven-year tamper-evident audit log. You'll build it alongside a dedicated team, and by the end of the term the whole environment must be rebuildable from code and ready to hand to the State.

THE ROLE AT A GLANCE

Engagement

1099 independent contractor; you work as part of HK's team

Term

November 2026 through September 2027; extensions for multiple years are possible, subject to performance and other variables

Commitment

Full time, 40 hours a week

Reports to

HK's Software/Development Director, with architecture direction from the program architect and security direction from the HIPAA Security Officer

Location

Hybrid, Salt Lake City, Utah; core hours 9:00 a.m.–3:00 p.m. Mountain; you must currently live in the U.S. and be able to travel to Salt Lake City approximately 25% of the time

Requirements

U.S. work authorization without sponsorship; current U.S. residence; identity verification with government-issued photo ID, confirmed in person at the final interview; background check before any system access; HIPAA training before any access

Stack

AWS (us-west-2, DR in us-east-2), EKS on Bottlerocket, Aurora PostgreSQL, MSK, S3 Object Lock, Keycloak, OpenSearch, OpenTofu, GitOps

WHAT YOU'LL DO

You take the platform from the first OpenTofu module to a production environment with a warm DR standby by spring, and you're the person who can rebuild it all from code.

- Build the AWS Organization as code: separate accounts for management, security, log archive, sandbox, test, staging and production, plus OUs, IAM Identity Center with MFA, and organization-wide CloudTrail and Config.
- Design the network: private-only VPCs across three AZs, egress inspected through Network Firewall, Transit Gateway, VPC endpoints, and Client VPN. You'll also set the partner connectivity patterns (site-to-site VPN, PrivateLink, mTLS with a private CA).
- Run Amazon EKS: private endpoint, Bottlerocket nodes with Karpenter, pod security standards, Cilium network policies, upgrades, and capacity and cost tuning for Kafka and Spark.
- Operate the data services: Aurora PostgreSQL (TLS, PITR, Global Database), MSK, S3 zones with Object Lock and cross-region replication, ECR, Secrets Manager and AWS Backup, plus Keycloak, Prometheus and OpenTelemetry on the cluster.
- Own the delivery pipeline: GitHub Actions with OIDC to AWS, OpenTofu plan and apply with policy gates, Argo CD, Helm conventions and Kyverno admission. Shipping should be easy for every engineering team on the program.
- Keep it running: write the runbooks, lead the monthly restore drill and the annual cold-rebuild test, take on-call for severity-1 platform incidents (15-minute acknowledgment), and run post-incident reviews.
- Report and hand over: report monthly on availability, capacity and tagged AWS spend. You'll prove portability on open-source equivalents (MinIO, Nessie, self-managed PostgreSQL) and hand the platform to the State's team with documentation they can run it from.
- Lead: guide a second platform engineer day to day and review the team’s infrastructure changes. You'll be able to cover each other's on-call.

YOUR FIRST 30 DAYS

The first three weeks are the critical path for the whole program. You'll pair with the Engineering team to stand up the landing zone, then hand it to the application teams.

Week

What success looks like

Week 1

Organization, accounts, SCPs, org-wide logging and security services live; KMS key plan applied

Week 2

Sandbox VPC, EKS, Aurora, MSK, S3, ECR and Keycloak provisioned from code; Client VPN working

Week 3

OpenSearch SIEM baseline, CI/CD with signing and policy gates, Argo CD syncing, cost budgets and tags; platform handed to engineering

Week 4

Test environment built from the same modules; first partner connectivity pattern documented; first monthly cost report

WHAT YOU BRING

- 7+ years in infrastructure or platform engineering, including 4+ years running production Kubernetes on AWS (EKS strongly preferred).
- Experience operating a regulated workload (HIPAA, FedRAMP, PCI) and the ability to explain what the regulation changed about the design in healthcare-specific environments.
- Deep Terraform or OpenTofu: multi-account organizations, modules, remote state, and policy as code (OPA, Checkov or tfsec). You've built an AWS Organization from zero before.
- Hands-on with VPC design, Transit Gateway, Network Firewall, PrivateLink, IAM Identity Center, KMS, Aurora PostgreSQL, MSK or Kafka, S3 Object Lock, ECR and AWS Backup.
- GitOps and CI: Argo CD or Flux, Helm, GitHub Actions, container image signing and SBOMs.
- Observability: Prometheus and Grafana, OpenTelemetry, and log shipping to OpenSearch or Elasticsearch.
- You write clear runbooks and ADRs, and you're comfortable leading and reviewing the work of one or two engineers.

NICE TO HAVE

- Karpenter and Bottlerocket in production; Cilium or Calico network policy.
- Spark on Kubernetes and Iceberg tables; Strimzi or MSK operations at scale.
- Keycloak or another OIDC provider; Kyverno or Gatekeeper.
- AWS Solutions Architect or DevOps Engineer Professional; CKA or CKS.
- Public-sector or healthcare delivery, and experience handing a platform over to a client team.

HOW WE HIRE

This role has production access to protected health information, so we verify every candidate carefully. These steps also protect you from recruiting scams that impersonate real employers.

- Video interviews are live with cameras on. The technical interview is a live session, no take home components.
- Finalists meet the team in person in Salt Lake City before any offer.
- Before the contract is signed, we verify your identity with government-issued photo ID (checked in person), confirm your W-9 taxpayer information with the IRS, and verify your U.S. address, work history, and references.
- We'll never ask you for money, equipment purchases, or banking details during the hiring process.
- We only contact candidates from an @hkconsulting.com email address. If someone reaches out about this role from any other address, please don't respond.