Posted today · be early
Cloud Engineer AWS ( CDK / Serverless) ( 102-09SENG-01 )
OpsBrasil Serviços Cloud LTDA
WorldwideremotePosted today
Skill Required
Cloud-EngineerAWS-CDKServerless-ArchitectureCloud-Infrastructure-EngineeringDevOps-EngineerAWS-Cloud-EngineerAWS-Serverless-EngineerAWS-CDK-EngineerAWS-CDK-Platform-EngineerCloud-Developer-(AWS)AWS-CloudFormation-EngineerAWS-DevOps-EngineerCloud-AWS-EngineeringServerless-EngineerAWS-EngineerCloud EngineerServerlessCloudAWSGitHub ActionsObservabilityTypeScriptServiceNowTerraformRESTNode.jssecurityGitCI/CDDesign PatternsIAMandFirewallCryptographyCICDContract
Key highlights
- 5+ years with AWS
- Estimated duration: 6–8 weeks
- 100% remote
- Must be located in EST or MST time zone
- Fluent English (C1 level) required
Role overview
This role involves modifying a live serverless gateway in production without downtime or behavioral changes, establishing a clean handoff for a downstream Terraform-managed build. This is a complex infrastructure modernization task involving careful surgery on production systems with active external consumers rather than a greenfield development project.
Responsibilities
- Inventory the CDK estate and build a modernization plan: upgrade the CDK library/CLI, replace deprecated constructs, move hardcoded context into per-environment config.
- Consolidate duplicated stacks into shared constructs without losing resource identity by mapping logical IDs before and after, selecting a preservation method, and confirming no replacements occur before production changes.
- Run the library upgrade and the stack refactor as two separate, ordered deployments, with a rollback path tested in dev and test first.
- Migrate all six Lambda functions from Node 18 to Node 24, close an open PII logging finding, and regression-test each one.
- Re-verify the security perimeter after both deployments—WAF, the mTLS domain and truststore, X-Ray tracing, upstream timeouts—working directly with the customer's POS team across all six external callers.
- Build deployment pipelines for dev/test/prod with OIDC federation, approval gates, and a ServiceNow change step.
- Add CDK assertion tests, drift detection, and API access log retention.
- Publish the SQS queue ARN and KMS key ARN via Parameter Store, and grant send permission to the downstream Terraform-managed system.
- Align naming, tagging, and documentation with the customer's internal standards, and document identity-preservation decisions clearly for future engineers.
Requirements
- 5+ years with AWS, including 3+ years working in infrastructure-as-code.
- Hands-on AWS CDK experience in TypeScript: construct trees, logical ID derivation, and what happens when a construct path changes.
- Real experience with CloudFormation resource identity: stack refactoring, logical ID overrides, cdk diff against deployed state, drift detection.
- Working Terraform knowledge: comfortable operating across the CDK/Terraform boundary.
- Solid AWS serverless background: Lambda, API Gateway (REST), SQS and DLQs, Parameter Store, KMS, Secrets Manager.
- Experience with AWS edge and security services: WAF web ACLs, mutual-TLS custom domains and truststores, cross-account/cross-boundary IAM.
- Practical experience migrating Nodejs runtimes (e.g. Node 18 → 24), including dependency and deprecation handling.
- CI/CD pipeline experience with OIDC federation and approval gates (GitHub Actions or equivalent).
- Working knowledge of observability tools: X-Ray, CloudWatch metrics and alarms, log retention.
- Comfortable communicating clearly with non-engineers, and working well when parts of the scope are still being figured out.
- Fluent English (C1 level) for daily communication with the client.
Additional details
- The scope includes modernizing a CDK estate made up of four stacks, six Lambda functions, a WAF web ACL, an mTLS custom domain/truststore, and a REST API.
- Hourly contractor
- 100% remote
- Estimated duration: 6–8 weeks
- Time zone: EST or MST
- Originally posted on Himalayas