Share this job
Senior AWS Systems Administrator
United States
Apply for this job

PLEASE CLICK HERE TO SEE *ALL* OF OUR JOB OPENINGS!


 

Senior AWS Systems Administrator


About the role

Seeking a Senior AWS Systems Administrator who owns the AWS environment end to end. Production, development, staging, the organization root, the billing alarms, the network topology, the audit trails, the keys, the access controls. If it lives in AWS, this seat is responsible for it being correctly configured, properly monitored, and ready for an auditor to walk through.

The platform runs on AWS and it handles PHI. That sentence carries the whole job. You configure the environments so that PHI moves only where it should move, encrypted at rest and in transit, audited at every hop, and tied back to a real identity that a HIPAA assessor can trace. You configure the networking so that a facility partner can route their on premises traffic into the company’s platform through a secure tunnel that holds up to scrutiny.

This is also the seat that owns the daily operational reality of business continuity and workforce identity. Backups either ran clean or they did not. Restores either work or they have not been tested recently enough. Every employee and contractor has exactly the access they should have, or they do not. You own those answers, every day.

Partnering closely with the engineering teams is an important part of this seat. You work alongside them on infrastructure decisions, and you own the operational reality of those decisions once they are made. You make sure the running system actually matches what the teams designed and agreed on.

What you will own

  • AWS account and organization configuration. You own AWS Organizations setup, account structure, service control policies, and the separation between production, staging, and development. You configure the landing zone, the guardrails, and the controls that keep one account's mistakes from leaking into another.
  • Networking and connectivity. This is the heart of the seat. You own VPC design, subnet layout, route tables, security groups, NACLs, and the Transit Gateway topology that ties it all together. You build site to site VPN tunnels and Transit Gateway attachments that let facility partners and integration partners reach the company from their own networks without ever exposing PHI to the public internet. You can explain BGP routing on a whiteboard, and you have configured customer gateways for partners running every kind of edge device you can think of.
  • Secure cross organization tunneling for PHI. Real facilities have their own IT infrastructure, and PHI has to move between their environment and this company under HIPAA rules. You design the tunnels. You configure the encryption. You document what flows where, and you can defend it to a compliance auditor. When a new facility partner needs to integrate, you are the one who walks their network team through the connection plan and gets it working.
  • Compute and data infrastructure. You administer EC2 fleets, Aurora PostgreSQL clusters, RDS, DynamoDB, ElastiCache, and the MSK Kafka event spine that ties this company’s services together. You handle capacity planning, scaling configuration, patch management, and broker health. You know what to do when an Aurora instance starts behaving badly at 3 AM, or when a Kafka consumer lag chart starts climbing in the wrong direction.
  • DNS and certificates. You own Route 53 zones, record management, and the routing rules that tie domains to environments. You manage ACM certificates, renewal automation, and the certificate inventory across the platform.
  • Identity, access, and Microsoft Entra ID. You own IAM and the bridge between IAM and the company directory. Microsoft Entra ID is the workforce identity backbone at this company. You configure Conditional Access policies, MFA enforcement, SSO federation into AWS IAM Identity Center, SCIM provisioning into GitHub Enterprise Managed Users and the rest of the SaaS stack, and the principle of least privilege as it actually plays out in a real organization where people need to get work done. You can answer who has access to what without reaching for a spreadsheet.
  • Microsoft 365 administration. You run the Microsoft 365 tenant. Exchange Online, SharePoint, Teams, OneDrive, and the license assignments that decide who gets which service. A new hire starts and you set up their Microsoft 365 account, switch on the services the role actually needs, and make sure the mailbox, the files, and the collaboration tools are live before their first morning. You maintain the Entra ID user groups and the policies that hang off them, so group membership drives access instead of someone hand granting it account by account. Tenant configuration, retention, sharing rules, and the licensing math that keeps the bill honest sit here too, all of it inside the same HIPAA boundary as the rest of the platform.
  • Workforce and contractor workspace provisioning. You own the daily lifecycle of every employee and contractor account. Onboarding a new hire means provisioning an Entra ID identity, group membership, NordLayer assignment, GitHub EMU seat, AWS IAM Identity Center entitlement, internal application access, MFA enrollment, and a hardware security key where the role requires one. Offboarding means revoking all of it cleanly, on time, and with audit evidence. The directory and the workspace stack are yours.
  • Business continuity and backup operations.You watch the backups every day. AWS Backup jobs across Aurora, RDS, DynamoDB, EBS, and S3 either ran clean or they did not, and you know which. You run restore drills on a defined cadence rather than as a fire drill. You maintain configuration state backups across Terraform or CDK state, Route 53 zones, IAM policies, AWS Config snapshots, and the secrets inventory, so that the platform can be rebuilt from code and state rather than from tribal memory. You own the recovery time and recovery point objectives once they are set, and you can produce evidence that the running platform actually meets them.
  • Monitoring, alerting, and infrastructure observability. You build the CloudWatch dashboards, the alarms, the log aggregation, and the SNS notifications that page the right person at the right time. You configure billing alarms that catch a runaway resource before it costs ten thousand dollars. You configure performance alerts that fire before a clinician notices latency.
  • Security and audit. You configure CloudTrail, AWS Config, GuardDuty, and Security Hub. You set up KMS keys with proper rotation, audit policies, and key usage logging. You manage Secrets Manager and Parameter Store. You can produce the audit evidence a HIPAA assessor asks for without scrambling for two days.
  • Infrastructure as code. Click ops is not part of this seat. You write your changes in code, you check them into version control, and you ship them through a deploy pipeline. AWS CDK in TypeScript is the current stack. Terraform translates.
  • Cost and capacity management. You watch the bill. You set the budgets. You catch the patterns that drive cost the wrong way, and you bring them to the team with a recommendation rather than a complaint.
  • Incident response. You are on the pager rotation. You write the runbooks. When something breaks in production at 2 AM, you are the one paged, and you lead the response and the post mortem the next day.
  • Other duties as assigned. This is an early stage company, and the role will flex as the business grows. Roles shift, scope moves, you go where the work is.

What success looks like

The Senior AWS Systems Administrator succeeds when nobody has to think about the infrastructure. PHI stays where it belongs, backups restore when needed, and the pager stays quiet.

Requirements

  • AWS administration depth. At least seven years administering production AWS environments, including time at a senior level where you owned outcomes rather than implemented someone else's design. You can talk through specific decisions you made on networking, IAM, compute, and data services, what they cost, what they enabled, and what you would do differently now.
  • VPC, Transit Gateway, and cross organization networking. Deep production experience with VPC design, Transit Gateway topology, site to site VPN, customer gateway configuration, and the operational reality of routing traffic between AWS and external networks. You have built and maintained tunnels between AWS environments and on premises partner networks, and you can defend the topology to a network engineer on the other side of the table.
  • HIPAA in production AWS. You have administered AWS environments that handle PHI. You know what a BAA scope looks like in practice, where the encryption boundaries sit, and what an auditor will ask for when they walk through your configuration. You have shipped real production systems under HIPAA, not just read the compliance documents.
  • Aurora PostgreSQL and RDS administration.You have run Aurora PostgreSQL in production at a senior level. Scaling, parameter tuning, backup configuration, point in time recovery, read replica strategy, failover behavior. You have been on the other end of a real outage and can describe what you did.
  • Backup, restore, and recovery operations.Production experience running scheduled backups across databases and infrastructure state, executing real restore drills on a cadence, and recovering systems from a real incident rather than from a tabletop exercise. You can describe a restore you actually performed, what failed, and what you fixed afterward.
  • IAM and identity federation. Expert level command of IAM. Roles, policies, cross account access, identity providers, SSO federation, MFA enforcement, and access boundaries. You have implemented least privilege in a real organization, not just on a slide.
  • Microsoft Entra ID and workforce identity.Production experience administering Microsoft Entra ID inside a Microsoft 365 environment. Conditional Access policy design, MFA enforcement, SCIM provisioning into downstream SaaS, hybrid or cloud only identity topology, and the lifecycle of employee and contractor accounts from onboarding through offboarding. You have administered the Microsoft 365 services that sit on top of the directory, Exchange, SharePoint, Teams, and license management, and you have maintained the Entra ID groups and policies that govern who reaches what. You have actually run a directory, not just inherited one.
  • Route 53 and DNS. Production experience with Route 53, including zone design, routing policies, health checks, and the failover patterns that keep a service reachable when something underneath it falls over.
  • Networking fundamentals. You can explain TCP, BGP, IPsec, TLS, and DNS without a search engine open in another tab. You understand what is actually happening when a packet leaves one VPC and arrives in another, and you can troubleshoot when it does not arrive.
  • Linux administration. Real production Linux experience. You know your way around systemd, the network stack, log files, and the tools you actually reach for when something is broken.
  • Infrastructure as code. AWS CDK in TypeScript, Terraform, or comparable production experience. You write your changes in code, and you do not consider a change done until it is in version control.
  • Monitoring and observability. Production experience with CloudWatch, log aggregation, distributed tracing, and the alerting patterns that page the right person at the right time without crying wolf.
  • AI tool fluency. Daily use of AI for operations work, documentation, runbook writing, and incident analysis. Anthropic Claude in particular. They use AI throughout the engineering workflow, and you should be working with it rather than around it.
  • On call discipline. You have carried a real production pager. You know what good incident response looks like, and you can teach it.
  • Education. A four year college degree from an accredited institution, or demonstrated engineering depth that makes a degree unnecessary. Show the work.

 

 

Preferred

  • EHR or healthcare infrastructure experience.Prior AWS administration on an EMR, EHR, or healthcare platform handling PHI. Bonus if you have worked with skilled nursing or assisted living operators.
  • HITRUST, SOC 2, or ONC. Time on an engineering team that took a product through a real audit. You know how compliance shapes infrastructure rather than treating it as paperwork bolted on at the end.
  • AWS Direct Connect. Production experience with Direct Connect, including the configuration patterns for partner connectivity that goes beyond what site to site VPN can carry.
  • Multi account AWS Organizations at scale.Production experience with Control Tower, account vending, SCP design, and the operational discipline of running a multi account environment correctly.
  • AWS certifications. AWS Solutions Architect Professional, Advanced Networking Specialty, or Security Specialty. The certification is not what they are buying. The depth that earned it is.
  • NordLayer or equivalent VPN platforms.Production experience configuring NordLayer, Tailscale, ZeroTier, or comparable cloud VPN platforms in a corporate or HIPAA context.
  • Multi region disaster recovery. You have designed and tested a real DR plan that goes beyond the database layer. You have failed over a production system to a different region and brought it back without losing data or trust.
  • GitHub Enterprise Managed Users. Hands on experience administering GitHub EMU with Entra ID OIDC and SCIM, including the operational quirks that come up when EMU and standard GitHub diverge.
  • Scripting depth. Python, Bash, or TypeScript for automation tasks beyond IaC. You can write the glue when there is no off the shelf tool for what needs to happen.
  • English proficiency. You communicate clearly in written and spoken English. Native fluency is not required. You can hold a video meeting, lead a runbook walkthrough, write a clear post mortem, and explain a networking decision to a partner's IT team without translation friction slowing the conversation. The team works across time zones, and most communication is asynchronous and written.


Job-3689793

*LI-MG1

#LI-Remote


Apply for this job
Powered by