Senior AWS Systems Administrator

About the role

Seeking a Senior AWS Systems Administrator who owns the AWS environment end to end. Production, development, staging, the organization root, the billing alarms, the network topology, the audit trails, the keys, the access controls. If it lives in AWS, this seat is responsible for it being correctly configured, properly monitored, and ready for an auditor to walk through. The platform runs on AWS and it handles PHI. That sentence carries the whole job. You configure the environments so that PHI moves only where it should move, encrypted at rest and in transit, audited at every hop, and tied back to a real identity that a HIPAA assessor can trace. You configure the networking so that a facility partner can route their on premises traffic into the company’s platform through a secure tunnel that holds up to scrutiny. This is also the seat that owns the daily operational reality of business continuity and workforce identity. Backups either ran clean or they did not. Restores either work or they have not been tested recently enough. Every employee and contractor has exactly the access they should have, or they do not. You own those answers, every day. Partnering closely with the engineering teams is an important part of this seat. You work alongside them on infrastructure decisions, and you own the operational reality of those decisions once they are made. You make sure the running system actually matches what the teams designed and agreed on.

Responsibilities

• AWS account and organization configuration – own AWS Organizations setup, account structure, service control policies, and separation between production, staging, and development; configure landing zone, guardrails, and controls to prevent account mistakes from leaking.
• Networking and connectivity – own VPC design, subnet layout, route tables, security groups, NACLs, and Transit Gateway topology; build site‑to‑site VPN tunnels and Transit Gateway attachments for facility and integration partners; explain BGP routing and configure customer gateways for various edge devices.
• Secure cross‑organization tunneling for PHI – design tunnels, configure encryption, document flows, defend to compliance auditors; walk new facility partners’ network teams through connection plans.
• Compute and data infrastructure – administer EC2 fleets, Aurora PostgreSQL clusters, RDS, DynamoDB, ElastiCache, and MSK Kafka event spine; handle capacity planning, scaling, patch management, broker health; respond to Aurora issues at 3 AM or Kafka consumer lag.
• DNS and certificates – own Route 53 zones, record management, routing rules; manage ACM certificates, renewal automation, and certificate inventory across the platform.
• Identity, access, and Microsoft Entra ID – own IAM and bridge to company directory; configure Conditional Access policies, MFA enforcement, SSO federation into AWS IAM Identity Center, SCIM provisioning into GitHub Enterprise Managed Users and SaaS stack; enforce least privilege; answer who has access to what without a spreadsheet.
• Microsoft 365 administration – run Microsoft 365 tenant (Exchange Online, SharePoint, Teams, OneDrive, license assignments); provision new hires, assign services, ensure mailbox, files, collaboration tools are live; maintain Entra ID user groups and policies governing access.
• Workforce and contractor workspace provisioning – own daily lifecycle of employee/contractor accounts: provision Entra ID identity, group membership, NordLayer assignment, GitHub EMU seat, AWS IAM Identity Center entitlement, internal app access, MFA enrollment, hardware security keys where required; offboard cleanly with audit evidence.
• Business continuity and backup operations – monitor AWS Backup jobs across Aurora, RDS, DynamoDB, EBS, S3; run restore drills on a defined cadence; maintain configuration state backups (Terraform/CDK state, Route 53 zones, IAM policies, AWS Config snapshots, secrets inventory); ensure recovery time and point objectives are met.
• Monitoring, alerting, and infrastructure observability – build CloudWatch dashboards, alarms, log aggregation, SNS notifications; configure billing and performance alerts.
• Security and audit – configure CloudTrail, AWS Config, GuardDuty, Security Hub; set up KMS keys with rotation, audit policies, key usage logging; manage Secrets Manager and Parameter Store; produce HIPAA audit evidence.
• Infrastructure as code – write changes in code (AWS CDK in TypeScript, Terraform), check into version control, ship through deploy pipeline.
• Cost and capacity management – watch the bill, set budgets, identify cost‑driving patterns, bring recommendations to the team.
• Incident response – be on pager rotation, write runbooks, lead response and post‑mortem for production breaks at 2 AM.
• Other duties as assigned – role will flex as the early‑stage company grows.
• Success looks like: nobody has to think about the infrastructure; PHI stays where it belongs; backups restore when needed; pager stays quiet.

Requirements

• AWS administration depth – at least seven years administering production AWS environments, including senior‑level experience owning outcomes; able to discuss specific decisions on networking, IAM, compute, data services, costs, enabled capabilities, and lessons learned.
• VPC, Transit Gateway, and cross‑organization networking – deep production experience with VPC design, Transit Gateway topology, site‑to‑site VPN, customer gateway configuration; built and maintained tunnels between AWS and on‑premises partner networks; able to defend topology to network engineers.
• HIPAA in production AWS – administered AWS environments handling PHI; know BAA scope in practice, encryption boundaries, auditor expectations; shipped real production systems under HIPAA.
• Aurora PostgreSQL and RDS administration – run Aurora PostgreSQL in production at senior level; scaling, parameter tuning, backup configuration, point‑in‑time recovery, read replica strategy, failover behavior; experienced real outages and recovery.
• Backup, restore, and recovery operations – production experience running scheduled backups across databases and infrastructure state; executing real restore drills on cadence; recovering systems from real incidents; able to describe a restore performed, what failed, and fixes applied.
• IAM and identity federation – expert‑level command of IAM (roles, policies, cross‑account access, identity providers, SSO federation, MFA enforcement, access boundaries); implemented least privilege in a real organization.
• Microsoft Entra ID and workforce identity – production experience administering Microsoft Entra ID inside Microsoft 365; Conditional Access policy design, MFA enforcement, SCIM provisioning into downstream SaaS, hybrid/cloud‑only identity topology; lifecycle of employee/contractor accounts from onboarding through offboarding; administered Exchange, SharePoint, Teams, license management; maintained Entra ID groups and policies governing access.
• Route 53 and DNS – production experience with Route 53 (zone design, routing policies, health checks, failover patterns).
• Networking fundamentals – able to explain TCP, BGP, IPsec, TLS, DNS without external references; understand packet flow between VPCs and troubleshoot.
• Linux administration – real production Linux experience with systemd, network stack, log files, and tools used when something breaks.
• Infrastructure as code – AWS CDK in TypeScript, Terraform, or comparable production experience; write changes in code and consider a change done only after version control.
• Monitoring and observability – production experience with CloudWatch, log aggregation, distributed tracing, alerting patterns that page the right person without false alarms.
• AI tool fluency – daily use of AI (e.g., Anthropic Claude) for operations work, documentation, runbook writing, incident analysis.
• On‑call discipline – carried a real production pager; know good incident response and can teach it.
• Education – four‑year college degree from an accredited institution, or demonstrated engineering depth that makes a degree unnecessary.