DevSecOps / Cloud Engineer

Where you'll contribute

Alongside the Director of Infrastructure and the Dev Team:

• Security architecture for Bedrock AI workloads: access controls, guardrails, PHI data boundaries
• Production incident response (reliability and security) and recurrence prevention
• Observability and cost visibility: CloudWatch, alarms, dashboards, tagging
• Partnership with application engineers on Lambda, Aurora PostgreSQL, and Bedrock workloads
• Lightweight threat modeling and security review of new features and third-party integrations touching PHI, including sponsor/CRO data-handling requirements
• 5+ years in DevSecOps, security, platform, or infrastructure engineering, operating production systems you were accountable for
• Demonstrated security ownership: you have run vulnerability management, remediated real findings, and participated in incident response - not just deployed tooling
• Deep Terraform proficiency: module hierarchies, multi-environment state, drift and refactors, critical plan review
• Hands-on AFT and Control Tower experience - you have vended accounts through AFT and customized the pipeline, not adjacent familiarity
• Broad AWS depth: IAM, Organizations, VPC, Lambda, RDS/Aurora, S3, KMS, CloudTrail, Config, Security Hub, GuardDuty, Secrets Manager
• GitHub Actions as a daily environment, including pipeline hardening and secrets management
• SOC 2 Type II and HIPAA experience in a real PHI-handling environment - you have owned controls, produced evidence, and sat in front of an auditor
• Change and release discipline: you think about blast radius before you apply, have owned deployment and rollback strategies in production, and move quickly inside regulated-environment constraints rather than treating them as obstacles
• Hands-on, autonomous, and clear: you write code daily, take ambiguous problems to documented decisions, and can explain security tradeoffs to non-security people
• You use AI coding and automation tools as a daily part of how you work, and you actively explore how they change infrastructure and security practices
• Genuine interest in improving clinical trial access and health equity
• Compliance automation platforms (Drata, Vanta) including evidence automation
• CloudFormation/CDK/Serverless-to-Terraform migration experience
• GitHub EMU, SCIM, and SAML SSO administration
• Aurora PostgreSQL operations and schema migration coordination
• Python or TypeScript for automation
• HITRUST, NIST 800-53, or CSA STAR exposure
• Securing LLM workloads