Cloud Architect

The Cloud Architect is a hands-on technical role within the Cloud Platform Engineering organization.  You will define and evolve the architecture of a secure, highly available, multi-account AWS platform supporting regulated SaaS applications. This role leads cloud platform modernization and transformation initiatives, owning architecture standards, reference designs, resilience patterns, and technical direction across platform and application engineering teams. You will assess existing systems, define pragmatic migration and modernization paths, turn business and product needs into target-state AWS architectures, and guide implementation so the platform becomes more scalable, secure, reliable, operable, cost-aware, and compliant.

Architecture ownership is central to this role: you will set platform standards and make architecture recommendations within the cloud domain, while implementation is delivered in partnership with platform engineering, security, operations, data, and application teams.

Position Responsibilities:

Cloud Architecture and Technical Strategy

• Define target-state AWS architectures, reference architectures, and decision records for secure, scalable, cloud-native SaaS platforms.

• Lead architecture reviews and translate product, engineering, and enterprise technology roadmaps into implementable cloud designs.

• Design modernization strategies spanning serverless services, Amazon ECS and AWS Fargate, EC2 Linux workloads, APIs, and event-driven components.

• Establish architectural standards for availability, scalability, performance, capacity, service boundaries, tenant isolation, and operational readiness.

• Guide to multi-region resilience and disaster-recovery architecture, including backup ownership, RTO and RPO targets, failover approaches, and restore testing.

Security, Compliance, and Risk Architecture

• Design cloud controls that support HIPAA regulatory requirements, SOC 2 attestation commitments, and HITRUST certification requirements.

• Partner with security and compliance teams to implement controls, maintain control-to-code mappings, produce audit evidence, support control walkthroughs, and remediate penetration-test findings.

• Define patterns for IAM, permission boundaries, AWS Organizations service control policies, KMS encryption, Secrets Manager, Parameter Store, and least-privilege access.

• Establish cloud security posture and vulnerability-management patterns using services such as AWS Config, Security Hub, Inspector, GuardDuty, CloudTrail, and centralized audit-log retention, as applicable to the environment.

• Ensure architecture decisions address data protection, secure tenant isolation, key management, secrets handling, and customer security requirements.

Networking, Data, and Platform Governance

• Define enterprise AWS networking patterns using Transit Gateway, Site-to-Site VPN, Direct Connect, PrivateLink, routing controls, and private service access.

• Set architectural direction for Amazon RDS for MySQL and Aurora, DynamoDB, ElastiCache, data durability, backup, recovery, replication, and performance tradeoffs.

• Own cloud landing-zone standards and multi-account governance across AWS Organizations and Control Tower, including account vending, guardrails, centralized logging, and policy enforcement.

• Create reusable Terraform module standards covering versioning, remote state, code review, drift detection, testing, and safe change management.

Modernization, Transformation, and Platform Enablement

• Assess current-state application and infrastructure environments, identify modernization opportunities, and create phased transformation roadmaps with clear business and technical outcomes.

• Develop migration and modernization patterns for rehosting, replatforming, refactoring, containerization, serverless adoption, and retirement of legacy services.

• Establish platform golden paths and self-service provisioning patterns that help engineering teams adopt approved AWS architectures consistently and securely.

• Define observability architecture across CloudWatch and Datadog, including service-level objectives, telemetry standards, alert quality, dashboards, and operational ownership.

• Improve operational readiness by defining patching, maintenance-window, change-management, exception, and customer-notification patterns for hosted environments.

• Lead or facilitate complex incident reviews and ensure that corrective actions result in durable architectural improvements.

• Help evaluate and pilot AI-assisted SRE or DevOps capabilities where they can safely improve incident triage, diagnosis, or remediation.

• Incorporate cost, performance, reliability, and security tradeoffs into architecture decisions and contribute to rightsizing, savings-plan, reservation, and tag-based cost-attribution initiatives.

• Communicate architecture decisions clearly to technical and non-technical stakeholders and build alignment across teams.

Implementation Partnership

• Guide platform and application teams as they implement approved architectures, resolve design issues, and transition modernized services into production.

• Use Terraform, Python, Bash, and lightweight delivery automation as needed to prove patterns, accelerate adoption, and remove implementation barriers; this is not primarily a CI/CD administration role.

• Provide architectural input to GitHub Actions or other delivery pipelines where deployment safety, testing, security validation, and traceability are required.

Position Requirements:

• 7+ years of experience in AWS cloud architecture, cloud engineering, platform engineering, or a related discipline, including substantial production AWS experience.

• Demonstrated ability to define and communicate AWS architectures for highly available, secure, scalable applications or SaaS platforms.

• Demonstrated experience leading cloud modernization or transformation programs from current-state assessment through migration, implementation, and operational adoption.

• Production experience with Terraform and Infrastructure as Code, including reusable modules, state management, versioning, testing, and drift control.

• Strong understanding of AWS networking, identity and access management, encryption, logging, monitoring, and multi-account architecture.

• Hands-on familiarity with AWS compute and application patterns, including ECS, Fargate, EC2 Linux, Lambda, and API Gateway.

• Experience designing or operating cloud environments subject to regulated or audited security requirements.

• Ability to influence engineering teams, lead architecture discussions, and make sound tradeoffs among security, reliability, performance, delivery speed, and cost.

Education/Certification Requirement: 

• Bachelor’s degree in Computer Science, Engineering, Information Systems, or a related field, or equivalent practical experience.

• AWS Certified Solutions Architect Associate, AWS Certified Solutions Architect Professional, or AWS Certified DevOps Engineer Professional; equivalent experience will be considered.

Preferred Qualifications

• Experience with healthcare software, medical technology, regulated technology, or multi-tenant SaaS platforms.

• Experience with compliance-as-code tools or practices such as AWS Config rules, OPA or Conftest, CIS benchmark hardening, or equivalent mechanisms.

Additional Requirements:

• Must reside in or be willing to relocate to the Tampa, FL area within 90 days of start for hybrid collaboration.  

At MHK we help health plans and pharmacy benefit managers deliver optimal care management across every member’s health journey.  We do this through state-of-the-art technology that provides critical insights from member enrollment and maintenance through every stage of care and compliance. We believe that long-term partnerships are built on trust. Our team members are expected to build trusted advisory relationships - with MHK clients and one another - through responsive, transparent communication, while honoring commitments, and tying that trust to outcomes.

Benefits Snapshot:

• Medical, vision, and dental plans for full time employees

• 401(k) offered with a generous match

• Benefits begin on first day of the month following employment   

• Exercise/Health Club reimbursement opportunity 

• Monthly dependent care reimbursement opportunity 

• Short Term and Long-Term disability 

• Basic Term Life and AD&D Insurance 

• Generous Paid Time Off and Holiday Schedule

EQUAL OPPORTUNITY EMPLOYER - VETERANS/DISABLED.