DevOps / Platform Engineer for Secure Healthcare App (AWS, HIPAA, CI/CD, Observability)

We are looking for a senior DevOps engineer to own the cloud, deployment, and operations layer for a secure healthcare mobile app. This is the person who makes our AWS environment reliable, repeatable, and safe to ship to every day: automated pipelines, infrastructure as code, monitoring that catches problems before users do, and a security posture that holds up to HIPAA and SOC 2 scrutiny. The app serves healthcare field representatives who need secure workflows for managing documents, credentials, status visibility, and facility access. You will work alongside our backend and mobile developers, owning the platform and delivery foundation the rest of the product depends on. You are not building app features. You are making sure everything the developers build ships safely and runs reliably. The first job is standing up the AWS environment from the ground up and migrating an existing production system into it, done right from the start instead of accruing technical debt. What you'll own: -CI/CD and SDLC: build, test, and deployment pipelines (GitHub Actions) that ship confidently to non-prod and prod, plus helping define a safe, practical SDLC for the team -Infrastructure as code: everything defined in Terraform or CDK, version controlled and reproducible, no click-ops -AWS platform: ECS Fargate, RDS, ElastiCache, S3, VPC and networking, and a well-architected landing zone with separate non-prod and prod environments (no real customer or PII data in non-prod) -Observability: metrics, logging, tracing, and alerting (CloudWatch, Datadog, Grafana, or similar) so issues surface early -Security and compliance ops: least-privilege IAM, secrets management, encryption in transit and at rest, audit logging, and building with HIPAA and SOC 2 in mind from day one -Reliability: cost control, right-sizing, backups and DR, and sensible incident response AWS services you'll support: The application depends on several managed AWS services beyond the core platform. You will not own the backend business logic, but you must be able to deploy, secure, monitor, and troubleshoot these services in production: -Lambda: packaging, IAM roles, environment variables, timeouts, concurrency, VPC configuration, logging, retries, and deployment through infrastructure as code -Step Functions: state machines, retries, failure paths, timeouts, asynchronous workflows, execution history, and monitoring -Textract: core API patterns, asynchronous document processing workflows, S3 integration, IAM permissions, SNS and EventBridge callbacks, quotas, errors, and cost considerations -Bedrock: model access and permissions, secure service integration, IAM configuration, logging and monitoring, guardrails, quotas, latency and cost management, and supporting production AI workflows such as document extraction, classification, and pre-screening Must have: -Hands-on AWS: ECS/Fargate or equivalent, RDS, S3, VPC, IAM, Secrets Manager -Infrastructure as code (Terraform) with real production experience -CI/CD pipeline design and maintenance (GitHub Actions strongly preferred) -Docker and containerization -Observability tooling: metrics, centralized logging, and alerting -Security fundamentals: least-privilege IAM, secrets handling, encryption, audit logging -AI-forward: uses AI tools to accelerate the work, with clear judgment about where not to rely on them in a regulated environment Strongly preferred: -HIPAA or other regulated-data experience (PHI, encryption at rest and in transit, audit logging) -Well-architected AWS landing zone, multi-account or multi-environment setups -Comfortable supporting a Python/FastAPI and PostgreSQL application in production (reading code, debugging deployments, tuning configuration) -Redis / ElastiCache and background job infrastructure -SOC 2 readiness or audit experience, including GRC platforms such as Vanta or Drata -AWS cost optimization experience