Senior Systems Engineer (AWS GovCloud)

Broadway Ventures

3d•$75 - $87

About The Position

The Senior Systems Engineer builds and operates the AWS GovCloud infrastructure hosting the Project Argos pipeline in Broadway Ventures’ contractor-owned GovCloud tenancy. The pipeline runs containerized ingestion, validation, endpoint observation, and evidence-assembly services. The engineer owns infrastructure as code, CI/CD, monitoring, and tamper-evident evidence storage, and produces technical control evidence supporting the project’s Authority to Operate (ATO). The role works with the Technical Lead, Application Developer, and project security lead. Project Argos is an agentic AI proof of concept for the Office of the National Coordinator for Health IT (ONC). It pulls published API endpoint data for roughly 290 certified health IT products from the Certified Health IT Product List (CHPL), tests endpoints on a repeatable schedule, and creates reproducible evidence cases for compliance gaps under 45 CFR Part 170. A qualified human reviews every finding before it becomes a confirmed issue. This is a part-time, one-year contract position, offered on either a W2 or 1099 B2B basis. W2 compensation is $65–$76 per hour; 1099 compensation is $75–$87 per hour. Applicants must live and work in an eligible U.S. state; the posting excludes California, Colorado, Connecticut, the District of Columbia, Hawaii, Illinois, Maryland, Massachusetts, New Jersey, New York, North Dakota, Ohio, Oregon, Rhode Island, Washington State, and Wyoming. The position requires the ability to obtain U.S. Public Trust. Broadway Ventures provides on-the-job training in FHIR, certified health IT regulatory content (45 CFR Part 170), and ONC program context; AWS production operations and federal security control experience must already be in hand.

Requirements

Experience with AWS ECS/Fargate, DynamoDB, S3, VPC networking, IAM, and CloudWatch.
Experience with Terraform or equivalent infrastructure as code.
Experience designing CI/CD pipelines and building, scanning, and deploying container images.
Experience operating containerized services in production.
Experience with monitoring, alerting, and incident response.
Networking fundamentals, including TLS/PKI, DNS, HTTP, and troubleshooting.
Experience with security controls in a regulated or federal environment, such as NIST 800-53 or similar.
Technical documentation skills.
Ability to obtain U.S. Public Trust.
AWS production operations and federal security control experience must already be in hand.
Must live and work from an eligible U.S. state; the position excludes California, Colorado, Connecticut, the District of Columbia, Hawaii, Illinois, Maryland, Massachusetts, New Jersey, New York, North Dakota, Ohio, Oregon, Rhode Island, Washington State, and Wyoming.

Nice To Haves

Active Public Trust or Secret clearance.
ATO or third-party security assessment experience.
Capacity planning and autoscaling experience.
Monitoring or outbound traffic management at scale.
Secrets management and S3 Object Lock or immutable storage experience.
Familiarity with HL7 FHIR, SMART on FHIR, or ONC certification programs.
AWS professional-level certification.

Responsibilities

Build and maintain the GovCloud environment, including ECS/Fargate, DynamoDB, S3, VPC, IAM, and CloudWatch, using Terraform or equivalent infrastructure as code and a secure deployment pattern aligned with government hosting and security requirements.
Design and operate CI/CD for container image builds, vulnerability scanning, and deployment, with release versioning that identifies the code, model, prompt, rule, and source version associated with each result.
Implement immutable or tamper-evident storage and logging for data ingestion, agent decisions, human review, evidence packaging, and release versions, using S3 Object Lock or equivalent controls.
Configure and manage outbound traffic so endpoint observation schedules are configurable and respect source rate limits across roughly 290 certified products.
Establish monitoring, alerting, and incident response for production services, and support the requirement to report suspected or confirmed security incidents within one hour.
Manage secrets, TLS/PKI, DNS, and network segmentation for the pipeline and its connections to CHPL, Lantern, and developer-published endpoints.
Write control implementation narratives and provide technical evidence for the System Security Plan and independent security assessment in collaboration with the project security lead.
Plan capacity and autoscaling so monitoring cycles meet targets of at least 95% coverage of applicable CHPL listings and at least 95% evidence completeness.
Keep architecture, runbooks, and configuration documentation current for knowledge transfer.