AWS Cloud Platform Engineer

We’re hiring AWS Cloud Platform Engineers to build and own the platform’s foundation. That means the AWS accounts, networking, identity and infrastructure-as-code everything runs on, plus the path from commit to running agent. Each engineer will have a main focus in one of the two areas below and work closely across both. This is a named-team engagement, so the person we propose is the person who starts.

• Infrastructure & IaC: Build and own the base AWS layer: accounts, networking, identity boundaries, and the reusable IaC modules the rest of the platform is built from.
• CI/CD & Runtime Deployment: Own the path from commit to running agent: container builds, Amazon ECR, pipelines, environment promotion, and AgentCore Runtime session configuration.

• Account and Environment Foundation: Design and stand up the multi-account AWS structure (Organizations, Control Tower or equivalent) with guardrails and service control policies.
• Networking: Build secure VPC designs and private connectivity (VPC endpoints, PrivateLink, Transit Gateway) so agent workloads can reach internal systems safely.
• Identity Boundaries: Define IAM roles, permission boundaries and least-privilege access for platform services, pipelines and consuming teams.
• Reusable IaC Modules: Build and maintain versioned Terraform and/or AWS CDK modules other teams can use with confidence.
• Build Pipelines: Design and own CI/CD pipelines that build, test, scan and publish agent containers to Amazon ECR.
• Environment Promotion: Automate promotion from dev to test to production with approval gates, rollback and version tracking.
• Runtime Deployment: Configure and deploy agents to AgentCore Runtime, including session settings, scaling, config and secrets handling.
• Golden Path Templates: Build starter repos and pipeline templates so every new agent is set up and shipped the same way.
• Security and Compliance: Build encryption, logging, tagging, image scanning and audit requirements in from the start, working with client security teams.
• Documentation and Enablement: Write module docs, decision records and runbooks so the platform doesn’t depend on any one person.

• 6+ years of cloud, platform or DevOps engineering experience, with at least 4 years hands-on building production AWS environments.
• Strong infrastructure-as-code skills with Terraform and/or AWS CDK/CloudFormation, including writing reusable modules.
• Deep understanding of AWS IAM, including cross-account access, permission boundaries and service control policies.
• Solid AWS networking knowledge: VPC design, routing, VPC endpoints, PrivateLink, Transit Gateway and DNS.
• Hands-on experience building CI/CD pipelines (GitHub Actions, GitLab CI, AWS CodePipeline/CodeBuild or similar).
• Strong container skills: Docker, Amazon ECR, and deploying to ECS, EKS, Fargate or Lambda.
• Experience with secrets and config management (AWS Secrets Manager, Parameter Store).
• Deep hands-on strength in at least one of the two focus areas, and working knowledge of the other.
• Clear communication and comfortable working in a blended client and vendor team.

• AWS certifications such as Solutions Architect Professional, DevOps Engineer Professional or Advanced Networking.
• Experience with Amazon Bedrock, AgentCore Runtime, or deploying LLM/agent-based applications.
• Experience with policy-as-code and supply chain security tools (e.g., OPA, Checkov, cosign, SBOM tooling, Amazon Inspector).
• Experience in pharma, life sciences or another regulated industry with strict security and change control requirements.

• You think in reusable building blocks and care about the engineers who use them after you
• You default to secure, least-privilege designs and can explain why
• You automate anything you have to do twice
• You write things down so decisions don’t live only in your head
• You work well inside a client team and build trust quickly
• You have prior experience in consulting
• Prior experience and connections in the Life Sciences industry is preferred