Senior Platform Engineer (Lead)

HK Tech•Salt Lake City, UT

1d•Hybrid

About The Position

Build, operate, and hand over the AWS landing zone and Kubernetes platform for a cloud-based, open-source semantic data model that harmonizes EHR, claims, and public-health data and serves it through FHIR APIs. The platform handles protected health information and must meet NIST SP 800-53 moderate controls and the HIPAA Security Rule, with 99.9% availability, a 15-minute RPO, a 4-hour RTO, and a seven-year tamper-evident audit log. The environment must be rebuildable from code and ready to hand over to the State. This is a full-time, 1099 independent-contractor engagement expected to run from November 2026 through September 2027, with possible multi-year extensions subject to performance and other variables. The role is hybrid in Salt Lake City, Utah, with core hours from 9:00 a.m. to 3:00 p.m. Mountain and travel to Salt Lake City approximately 25% of the time. Candidates must currently reside in the United States and have U.S. work authorization without sponsorship. The position reports to HK's Software/Development Director, with architecture direction from the program architect and security direction from the HIPAA Security Officer. The lead will guide a second platform engineer day to day and review infrastructure changes. The stack includes AWS (us-west-2, with disaster recovery in us-east-2), EKS on Bottlerocket, Aurora PostgreSQL, MSK, S3 Object Lock, Keycloak, OpenSearch, OpenTofu, and GitOps. The engineer will establish the AWS Organization, private network architecture, Kubernetes platform, data services, and delivery pipeline; operate the platform and its recovery processes; report on availability, capacity, and tagged AWS spend; demonstrate portability using open-source equivalents; and document and hand over the platform. The role includes on-call responsibility for severity-1 platform incidents, with a 15-minute acknowledgment requirement. Access requirements include identity verification using government-issued photo ID, confirmed in person at the final interview; a background check before system access; and HIPAA training before access. The hiring process includes live video interviews and an in-person meeting with finalists in Salt Lake City before an offer.

Requirements

At least 7 years of infrastructure or platform engineering experience, including at least 4 years operating production Kubernetes on AWS; EKS is strongly preferred.
Experience operating a regulated workload, such as HIPAA, FedRAMP, or PCI, and ability to explain how regulatory requirements changed the design in healthcare-specific environments.
Deep Terraform or OpenTofu experience, including multi-account organizations, modules, remote state, and policy as code such as OPA, Checkov, or tfsec.
Prior experience building an AWS Organization from zero.
Hands-on experience with VPC design, Transit Gateway, Network Firewall, PrivateLink, IAM Identity Center, KMS, Aurora PostgreSQL, MSK or Kafka, S3 Object Lock, ECR, and AWS Backup.
Experience with GitOps and CI, including Argo CD or Flux, Helm, GitHub Actions, container image signing, and SBOMs.
Experience with Prometheus and Grafana, OpenTelemetry, and log shipping to OpenSearch or Elasticsearch.
Ability to write clear runbooks and ADRs and lead and review the work of one or two engineers.
U.S. work authorization without sponsorship and current U.S. residence.
Ability to travel to Salt Lake City approximately 25% of the time.
Identity verification with government-issued photo ID, confirmed in person at the final interview; background check before system access; and HIPAA training before access.

Nice To Haves

Production experience with Karpenter and Bottlerocket.
Experience with Cilium or Calico network policy.
Experience with Spark on Kubernetes and Iceberg tables.
Experience with Strimzi or operating MSK at scale.
Experience with Keycloak or another OIDC provider.
Experience with Kyverno or Gatekeeper.
AWS Solutions Architect or DevOps Engineer Professional certification.
CKA or CKS certification.
Public-sector or healthcare delivery experience.
Experience handing a platform over to a client team.

Responsibilities

Build the AWS Organization as code, including management, security, log archive, sandbox, test, staging, and production accounts; organizational units; IAM Identity Center with MFA; and organization-wide CloudTrail and Config.
Design private-only VPCs across three availability zones, with inspected egress through Network Firewall, Transit Gateway, VPC endpoints, and Client VPN; establish partner connectivity patterns using site-to-site VPN, PrivateLink, and mTLS with a private CA.
Run Amazon EKS with a private endpoint, Bottlerocket nodes and Karpenter, pod security standards, Cilium network policies, upgrades, and capacity and cost tuning for Kafka and Spark.
Operate Aurora PostgreSQL, MSK, S3 zones with Object Lock and cross-region replication, ECR, Secrets Manager, AWS Backup, and Keycloak, Prometheus, and OpenTelemetry on the cluster.
Own the delivery pipeline using GitHub Actions with OIDC to AWS, OpenTofu plan and apply with policy gates, Argo CD, Helm conventions, and Kyverno admission.
Write runbooks; lead monthly restore drills and the annual cold-rebuild test; take on-call for severity-1 platform incidents with a 15-minute acknowledgment; and run post-incident reviews.
Report monthly on availability, capacity, and tagged AWS spend.
Demonstrate portability using open-source equivalents, including MinIO, Nessie, and self-managed PostgreSQL, and hand the platform over to the State's team with operational documentation.
Guide a second platform engineer day to day, review the team's infrastructure changes, and provide reciprocal on-call coverage.
Stand up the landing zone with the Engineering team and hand it to application teams during the initial weeks.
Build the test environment from shared modules, document the first partner connectivity pattern, and produce the first monthly cost report.