The Role
Lead production stand-up and cutover for a Canadian AWS environment: create org-separated production account, apply Terraform modules, configure KMS/IAM/SCPs, enable CI/CD gated deploys, deploy key-custody and blockchain keys, validate runbooks, perform vendor and KYC/ComplyAdvantage integrations, execute production cutover and hyper-care.
Summary Generated by Built In
- Production stand-up (early in the engagement).
- Create the production AWS account in the Canadian region
(ca-central-1), organizationally separate from staging, with Organization-level
federation. This requires AWS Organization administrator credentials Parx alone
cannot exercise
- Apply the Parx-built Terraform modules to the production
account: baseline service-control policies (data residency, root denial,
multi-factor authentication, public-S3 denial, security-service denial),
customer-managed KMS keys, least-privilege IAM roles, CloudWatch alarms and log
shipping, S3 with seven-year Object Lock retention, AWS Secrets Manager with
rotation lambdas
- Activate the CI/CD production pipeline with
environment-gated deploys (manual approval required for production)
- Production deployment of the signed-receipt KMS asymmetric
migration (already validated in dev and staging)
- Production deployment of the operational key-custody
infrastructure (already validated in dev and staging): rotating service keys
for the application layer, validator keys for the permissioned blockchain
nodes, and privacy keys for the private-transaction layer
- Validate the Parx-drafted production runbooks against the
live environment; revise where production behaviour differs from staging
- Live vendor cutover (sequenced through the active
window).
- (KYC) - swap the Parx-built adapter from mock mode to live
Persona sandbox credentials in dev and staging, then production cutover
- Comply Advantage (sanctions, politically-exposed-person,
adverse-media screening) - same pattern, sandbox then production
- Balance Custody (qualified custodian,
multi-party-computation 2-of-3 architecture) - testnet integration (target end
of June 2026); production cutover at the production key ceremony
- Production cutover and hyper-care (S-anchored).
Skills Required
- Create and configure production AWS account in ca-central-1 with AWS Organizations and federation
- Apply Parx-built Terraform modules to production account (baseline SCPs, KMS, IAM, CloudWatch, S3 retention, Secrets Manager)
- Implement and manage customer-managed KMS keys including asymmetric KMS migration
- Design and enforce least-privilege IAM roles and organization-level service-control policies
- Configure CloudWatch alarms and log shipping
- Configure S3 with seven-year Object Lock retention
- Implement AWS Secrets Manager with rotation Lambdas
- Activate CI/CD production pipeline with environment-gated deploys and manual approval for production
- Deploy operational key-custody infrastructure (rotating service keys, validator keys, privacy keys)
- Validate and update production runbooks against live environment behaviour
- Perform live vendor cutover sequenced through active windows
- Integrate KYC adapter (Persona) from mock to sandbox in non-prod and perform production cutover
- Integrate ComplyAdvantage sandbox then perform production cutover for sanctions/PEP/adverse-media screening
- Integrate Balance Custody testnet and participate in production key ceremony for cutover
- Lead production cutover and provide hyper-care support
Am I A Good Fit?
Get Personalized Job Insights.
Our AI-powered fit analysis compares your resume with a job listing so you know if your skills & experience align.
Success! Refresh the page to see how your skills align with this role.
The Company
What We Do
Maarut Inc. is a Canadian company specializing in IT services, technology staffing, and software development, dedicated to assisting businesses with digital transformation and solving business challenges through technology.
