Senior Devops Engineer (AWS)

Reports to: Technical Leadership

Location: Remote

Salary Range: $95,000-$130,000 per year

About the role: We're looking for our first dedicated, in-house AWS/Dev Ops engineer to own infrastructure, reliability, and deployment tooling across a portfolio of live, revenue-generating products. You'll be the technical owner for cloud infrastructure spanning multiple AWS accounts, supporting several distinct applications with their own architectures and audiences —plus the shared services that cut across all of them. What you'll own• Multi-account AWS architecture — administer and harden a multi-account AWS Organization (production, development, and monitoring accounts) with least-privilege IAM, proper root/administrative credential hygiene, and durable secrets management (moving us off ad-hoc password storage and onto a real secrets manager).• Compute & scaling — manage EC2 fleets behind Application Load Balancers, Auto Scaling Groups, and launch templates backed by a golden-AMI deployment pipeline; modernize legacy standalone instances toward containerized (ECR/ECS) or otherwise more resilient patterns where it makes sense.• Databases — administer Amazon Aurora MySQL clusters (multi-database, multi-tenant schemas) including read replica strategy, credential scoping (moving application traffic off shared/master-level database users onto least-privilege service accounts), and CDC-based real-time data pipelines (Epsio) feeding BI and marketing systems.• Networking & access — operate a Tailscale-based zero-trust network (ACLs, subnet routers, tagged service identities) as our primary access layer, including migrating legacy DNS off a legacy registrar onto modern DNS/CDN infrastructure (Cloudflare / Route 53).• CI/CD — own and improve Git Lab CI/CD pipelines (OIDC-based AWS role assumption, environment-scoped deploys, secrets-as-CI-variables) across a PHP monolith and a Laravel application; drive the migration of hardcoded application secrets into properly managed CI/CD variables and parameter stores.• Observability & incident response — build out real monitoring where gaps exist today (Cloud Watch Logs/Alarms/Synthetics, external uptime monitoring, WAF logging), define on-call/runbook practices, and lead incident response for production issues, including root-cause writeups.• Security posture — manage AWS WAF rules, resolve longstanding dependency/composer security advisories, own certificate lifecycle management (TLS, Apple Pay/payment-processing certs), and generally reduce the accumulated operational risk of a fast-growing, historically under-resourced infrastructure.• Cross-team support — work directly with a small in-house engineering team and outside contractors, and interface with third-party MSPs supporting sibling properties. Our stack (what you'll actually touch)• AWS: EC2, Aurora MySQL (RDS), Application Load Balancer, Auto Scaling Groups, S3, Storage Gateway, Elasti Cache (Memcached), Cloud Watch (Logs, Alarms, Synthetics, Internet Monitor), Systems Manager (Session Manager, Parameter Store), IAM & AWS Organizations, SES, WAFv 2, Cloud Formation• Application layers: Legacy PHP (no framework) and Laravel (PHP framework); Apache/PHP-FPM and nginx; Composer dependency management• Data & BI: Aurora MySQL, Epsio (CDC/real-time materialized views), Sigma (BI), Metabase (legacy BI, being retired)• Networking: Tailscale (zero-trust mesh VPN, ACL policy management), Cloudflare (DNS/CDN), legacy DNS providers (migration in progress)• CI/CD & tooling: Git Lab CI/CD, OIDC-based cloud role assumption, Php Storm/Jet Brains tooling, Last Pass (transitional— a real secrets manager is part of the roadmap)• Third-party integrations: Payment processing (Card Pointe/Card Connect, Apple Pay, Google Pay, Pay Pal), SMS/messaging (Twilio, Plivo), CRM/marketing (Hub Spot), accounting exports What you bring• 5+ years in a Dev Ops/SRE/Infrastructure role with deep, hands-on AWS experience (not just "used AWS" — configuredIAM policies, debugged Aurora replication, tuned Auto Scaling, written Cloud Formation/Terraform from scratch).• Real production incident experience: you've diagnosed a live outage under pressure, found the actual root cause (notjust the symptom), and closed every downstream copy of the fix (config, image/AMI, and CI/CD source of truth) — notjust the first thing that unblocked traffic.• Strong Linux systems administration fundamentals — filesystems, systemd, log management, disk/volume operations, recovering access to a box when the "normal" path (SSH key, SSM agent) isn't available.• Experience with CI/CD pipeline design (Git Lab CI/CD strongly preferred) and secrets management done right.• Comfort working across old and new: you can support and gradually modernize a 10+ year old PHP codebase while alsobuilding out reliability tooling for a newer Laravel application, without treating either as beneath you.• Excellent judgment around production risk — knowing when to move fast, when to get a second pair of eyes, and how tocommunicate a live incident clearly to non-technical stakeholders.

Nice to have: • Experience with CDC/real-time data replication tools (Debezium, Epsio, or similar).• Experience with Tailscale or another zero-trust/mesh VPN platform.• Payment processing / PCI-adjacent infrastructure experience.• Prior experience being the first dedicated Dev Ops hire at a company — you like building the practices, not just followingthem.• Experience using AI coding/ops tools (e.g., Claude Code or similar) as part of your actual workflow — for infrastructureinvestigation, incident diagnosis, or accelerating day-to-day Dev Ops work, not just general familiarity with AI chatbots.