Senior Platform Engineer (Lead)

HK Tech•Salt Lake City, UT

2d•Hybrid

About The Position

Build, operate, and hand over an AWS landing zone and Kubernetes platform for a HIPAA-regulated public-health data platform. The platform will support a cloud-based, open-source semantic data model that harmonizes EHR, claims, and public-health data and serves it through FHIR APIs. It handles protected health information and is subject to NIST SP 800-53 moderate controls and the HIPAA Security Rule, with targets of 99.9% availability, a 15-minute RPO, a 4-hour RTO, and a seven-year tamper-evident audit log. The engineer will build the platform from the first OpenTofu module through production, including a warm disaster-recovery standby, and ensure the environment can be rebuilt from code. The role is a full-time, 1099 independent-contractor engagement from November 2026 through September 2027, with possible multi-year extensions subject to performance and other variables. It is hybrid in Salt Lake City, Utah, with core hours from 9:00 a.m. to 3:00 p.m. Mountain and travel to Salt Lake City approximately 25% of the time. The engineer must currently reside in the U.S. and have U.S. work authorization without sponsorship. The role reports to HK's Software/Development Director, with architecture direction from the program architect and security direction from the HIPAA Security Officer. It includes day-to-day guidance of a second platform engineer and review of the team's infrastructure changes. The technology stack includes AWS (us-west-2, with disaster recovery in us-east-2), EKS on Bottlerocket, Aurora PostgreSQL, MSK, S3 Object Lock, Keycloak, OpenSearch, OpenTofu, and GitOps. The engagement requires identity verification with a government-issued photo ID, confirmed in person at the final interview; a background check before system access; and HIPAA training before any access. The platform must be documented and handed over to the State's team in a form they can operate.

Requirements

At least 7 years of infrastructure or platform engineering experience, including at least 4 years running production Kubernetes on AWS; EKS is strongly preferred.
Experience operating a regulated workload such as HIPAA, FedRAMP, or PCI, and ability to explain how regulatory requirements changed the design in healthcare-specific environments.
Deep Terraform or OpenTofu experience, including multi-account organizations, modules, remote state, and policy as code such as OPA, Checkov, or tfsec.
Prior experience building an AWS Organization from zero.
Hands-on experience with VPC design, Transit Gateway, Network Firewall, PrivateLink, IAM Identity Center, KMS, Aurora PostgreSQL, MSK or Kafka, S3 Object Lock, ECR, and AWS Backup.
GitOps and CI experience with Argo CD or Flux, Helm, GitHub Actions, container image signing, and SBOMs.
Observability experience with Prometheus and Grafana, OpenTelemetry, and log shipping to OpenSearch or Elasticsearch.
Ability to write clear runbooks and ADRs and lead and review the work of one or two engineers.
U.S. work authorization without sponsorship and current U.S. residence.
Ability to travel to Salt Lake City approximately 25% of the time.
Identity verification with government-issued photo ID, confirmed in person at the final interview; background check before system access; and HIPAA training before any access.

Nice To Haves

Production experience with Karpenter and Bottlerocket.
Experience with Cilium or Calico network policy.
Experience with Spark on Kubernetes and Iceberg tables.
Experience with Strimzi or operating MSK at scale.
Experience with Keycloak or another OIDC provider.
Experience with Kyverno or Gatekeeper.
AWS Solutions Architect or DevOps Engineer Professional certification.
CKA or CKS certification.
Public-sector or healthcare delivery experience.
Experience handing a platform over to a client team.

Responsibilities

Build the AWS Organization as code, including separate management, security, log archive, sandbox, test, staging, and production accounts; organizational units; IAM Identity Center with MFA; and organization-wide CloudTrail and Config.
Design private-only VPCs across three Availability Zones, with egress inspected through Network Firewall, Transit Gateway, VPC endpoints, and Client VPN.
Establish partner connectivity patterns, including site-to-site VPN, PrivateLink, and mTLS with a private certificate authority.
Operate Amazon EKS with a private endpoint, Bottlerocket nodes and Karpenter, pod security standards, Cilium network policies, upgrades, and capacity and cost tuning for Kafka and Spark.
Operate Aurora PostgreSQL with TLS, point-in-time recovery, and Global Database; MSK; S3 zones with Object Lock and cross-region replication; ECR; Secrets Manager; AWS Backup; and Keycloak, Prometheus, and OpenTelemetry on the cluster.
Own the delivery pipeline using GitHub Actions with OIDC to AWS, OpenTofu plan and apply with policy gates, Argo CD, Helm conventions, and Kyverno admission.
Write runbooks; lead monthly restore drills and an annual cold-rebuild test; take on-call responsibility for severity-1 platform incidents with a 15-minute acknowledgment target; and conduct post-incident reviews.
Report monthly on availability, capacity, and tagged AWS spend.
Prove portability using open-source equivalents such as MinIO, Nessie, and self-managed PostgreSQL, and hand over the platform with documentation the State's team can use to operate it.
Guide a second platform engineer day to day, review the team's infrastructure changes, and provide reciprocal on-call coverage.
Pair with the Engineering team during the first three weeks to establish the landing zone and then hand it to the application teams.
Build the initial organization, accounts, SCPs, organization-wide logging and security services, and KMS key plan during week one.
Provision the sandbox VPC, EKS, Aurora, MSK, S3, ECR, and Keycloak from code, and make Client VPN operational during week two.
Establish an OpenSearch SIEM baseline, CI/CD with signing and policy gates, Argo CD syncing, cost budgets and tags, and hand the platform to engineering during week three.
Build the test environment from the same modules, document the first partner connectivity pattern, and deliver the first monthly cost report during week four.