AWS DevOps/Security Engineer Senior/Architect

Role Summary The engineer will design, build, secure, automate, operate, and support AWS environments for the HMS Modernization and Teradata Migration programs. This is a broad hands-on AWS platform role covering cloud infrastructure, networking, security, automation, CI/CD, observability, managed services, and production operations. Terraform is a primary automation tool, but the position is not limited to Terraform.  Key Responsibilities - Design, build, and operate AWS environments across DEV, TEST, UAT, PROD, and DR. - Manage AWS accounts, service quotas, resource governance, tagging, cost controls, and environment readiness. - Implement private VPC/spoke architecture, subnetting, routing, Cloud WAN, VPC endpoints, PrivateLink, DNS, and private connectivity. - Coordinate integrations with corporate networks, firewalls, Netskope, on-premises systems, and shared AWS network services. - Build and support EC2, S3, RDS, MWAA, Lambda, ALB/NLB, Cognito, Route 53, Secrets Manager, Systems Manager, and related AWS services. - Design IAM roles, trust relationships, permission policies, instance profiles, permission boundaries, and cross-account access. - Implement KMS encryption, certificate management, S3 security, secrets management, vulnerability remediation, and compliance controls. - Develop infrastructure automation using Terraform, AWS CloudFormation where appropriate, AWS CLI, Python, PowerShell, and Bash. - Build and maintain GitHub-based CI/CD pipelines for infrastructure and application deployments. - Establish automated validation, security scanning, policy checks, approval gates, release controls, and rollback procedures. - Implement CloudTrail, CloudWatch, VPC Flow Logs, AWS Config, SNS alarms, dashboards, and centralized operational monitoring. - Support AWS MWAA/Airflow, RDS PostgreSQL, S3 landing zones, bastion services, and private application access. - Troubleshoot complex IAM, KMS, DNS, routing, firewall, endpoint, Linux, EC2, database, and managed-service issues. - Perform architecture reviews, cost optimization, capacity planning, disaster recovery planning, and production-readiness assessments. - Create architecture diagrams, operational procedures, support runbooks, compliance evidence, and recovery documentation. - Participate in production support, incident response, root-cause analysis, and service improvement. Required Experience - 8+ years of hands-on AWS cloud engineering, DevOps, platform engineering, or cloud security experience. - Strong knowledge of AWS networking, IAM, KMS, S3, EC2, RDS, Lambda, CloudWatch, Systems Manager, and private service connectivity. - Experience operating private, regulated, or enterprise AWS environments. - Strong infrastructure-as-code experience with Terraform; CloudFormation or AWS CDK experience is beneficial. - Experience with GitHub Actions or comparable CI/CD platforms. - Proficiency with AWS CLI, Linux, Python, PowerShell, and Bash automation. - Understanding of identity federation, SAML/OIDC, secrets management, certificates, encryption, and least-privilege access. - Ability to troubleshoot across cloud infrastructure, networking, security, application, and on-premises boundaries. - Experience with monitoring, incident response, change management, and production operations.Preferred - AWS Solutions Architect, DevOps Engineer, Security, or Advanced Networking certification. - Experience with AWS MWAA, Airflow, Cognito, RDS PostgreSQL, Network Firewall, Cloud WAN, Netskope, or Cloudera on AWS. - Experience supporting healthcare, government, or other regulated workloads. At Tieto, we believe in the power of diversity, equity, and inclusion. We encourage applicants of all backgrounds, genders (m/f/d), and walks of life to join our team, as we believe that this fosters an inspiring workplace and fuels innovation. Our commitment to openness, trust, and diversity is at the heart of our mission to create digital futures that benefit businesses, societies, and humanity. Diversity, equity and inclusion | Sustainability | Tieto Stay alert to recruitment scams: • Tieto only communicates via @tieto.com email addresses. • We never ask candidates to pay fees or share financial details during recruitment. • If you receive a suspicious message claiming to be from Tieto, don't respond — verify it via our official careers site. • For more information visit Important Advisory Regarding Recruitment Fraud | Tieto Blog