Senior AWS Cloud and Platform Engineer

Svitla Systems Inc. is looking for a Senior AWS Cloud and Platform Engineer for a full-time position (40 hours per week) on a short-term basis (16 weeks) in LATAM. Our client is a food industry company located in Seattle, Washington, that runs its daily operations from its own on-premises data center, which is its primary infrastructure. Its core systems run on VMware there, including Microsoft Dynamics GP on SQL Server and a warehouse management system. Orders also arrive through a third-party ordering platform with no API, and retail partners trade through EDI. Staff work on virtual desktops and sign in through Okta. The company already runs its disaster recovery environment on AWS, keeps some services on Azure, and uses Microsoft 365.

You own the AWS platform the pod’s agents run on: accounts and environments, identity and access, infrastructure as code, deployment pipelines, secrets, private links to the on-premises data center, monitoring, audit logging, and cost. You build this foundation in the first workflow and reuse it for each one after, so every new workflow costs less to deliver.

You will be one of three people who stay with the pod throughout. You will schedule your work, releases, and access requests with the Outcome Lead, Svitla’s delivery manager for the pod. The Forward Deployed Technical Lead owns the architecture, and specialists in agents and MCP, data, integration, and document AI join as each workflow needs them. You will also be the pod’s link to our client’s IT and security team, and you will get their sign-off before anything reaches production.

Requirements

• 5+ years of hands-on production experience with AWS.
• Experience with AWS Organizations or Control Tower, service control policies, and IAM Identity Center.
• Experience with IAM roles, permission boundaries, and short-lived credentials for people, services, and agents.
• Experience with VPC design with private subnets, endpoints, and PrivateLink, plus site-to-site VPN to on-premises.
• Experience with ECS on Fargate or EKS, Lambda, API Gateway, Step Functions, SQS, and EventBridge.
• Experience with Amazon Bedrock: model access, guardrails, private endpoints, invocation logging, and quotas.
• Experience with S3, Secrets Manager, KMS, CloudWatch, CloudTrail, AWS Config, and Security Hub.
• Experience with cost control using tagging, Cost Explorer, budgets, and anomaly alerts.
• Experience with Terraform (preferred) or AWS CDK, including modules, remote state, and code review.
• Experience with CI/CD (GitHub Actions, GitLab CI, or AWS CodePipeline), including automated tests, approvals, and rollback.
• Experience with policy as code and security scanning in the pipeline (for example, OPA, Checkov, or tfsec).
• Experience with Docker, Python, and Bash, plus PowerShell for the Windows side.
• Experience running LLM applications or agents in production, not only prototypes.
• Experience hosting MCP servers and tool APIs with authentication, rate limits, and a log of every call.
• Experience with approval gates and rollback paths for agents that change records.
• Experience tracing each agent step: errors, latency, tokens, and cost (for example, OpenTelemetry or Langfuse).
• Experience with evaluation sets in the pipeline, with thresholds that can block a release.
• Experience with isolated sandboxes for browser automation (for example, Playwright) against web applications with no API.
• Experience with defenses against prompt injection and data leaks: scoped tools, egress controls, and output checks.
• Experience integrating Okta with AWS IAM Identity Center through SAML, with SCIM provisioning.
• Experience with Active Directory and Microsoft Entra ID: groups, service accounts, and hybrid identity.
• Experience providing read-only access to SQL Server replicas and reporting databases without adding load to production.
• Experience with SFTP file exchange with partners and vendors using key pairs and IP allow-lists, never shared passwords.
• Fluent English, with the ability to explain data flows and risks in plain language to a careful security team.
• Ability to write runbooks that the client’s IT team can follow at 2 a.m., and architecture decision records.
• Working from a time zone ahead of US Pacific Time, with at least 4 hours of overlap with Pacific business hours.
• Availability for planned evening or weekend releases, and for travel to Seattle when the client asks.

Will be a plus

• AWS Professional or Specialty certification (DevOps Engineer, Security, or Advanced Networking).
• Experience with document AI on AWS, such as Amazon Textract or Bedrock Data Automation.
• Working knowledge of Azure and Microsoft 365, which the client also uses.
• Experience with Microsoft Dynamics GP or SQL Server data, and EDI file exchange (SPS Commerce, AS2, SFTP).
• Experience in the food industry or other 24/7 operations.

Responsibilities

• Agree the access path and control baseline with the client’s IT and security team (Okta, virtual desktops, and AWS accounts), then build the environments, pipeline, and secrets management as code.
• Build private, encrypted links from AWS to the on-premises data center, so that agents reach data through read-only replicas, the reporting database, and queues, never through production systems.
• Connect Okta to AWS, give people and agents separate identities, enforce data access in the platform rather than in prompts, and keep every service and agent on least privilege.
• Host agent services, MCP servers, Amazon Bedrock model access, and a document extraction service that keeps every document in the client’s accounts, with approval gates and rollback for agents that act.
• Run browser automation for the ordering platform in an isolated sandbox, with synthetic checks and alerts.
• Log every agent step to an audit trail, alert users and the pod when a check fails, and report AWS and model cost per workflow each month.
• Deploy every change through the pipeline, never by hand in the console, with releases gated on each workflow’s test set and evaluation thresholds.
• Prepare the runbook and the evidence pack that the client’s security team reviews before go-live.
• Support each workflow after go-live until it runs without intervention.
• Train the client’s IT team to run and extend the platform.