DevOps Engineer

We are seeking an experienced Infrastructure / DevOps Engineer to own and evolve the cloud infrastructure behind our HIPAA-compliant healthcare document processing platform. Our stack is AWS-native and PHI-handling, built on PHP 8.3 / Symfony, React, Aurora MySQL, and MongoDB. It is a distributed system composed of many microservices tied together by a central REST API that are each deployed and scaled independently. You will design, automate, secure, and troubleshoot the systems that keep a multi-tenant, compliance-sensitive platform running reliably.

The ideal candidate is deeply comfortable in Linux environments, thinks in automation and infrastructure-as-code, and treats security and compliance as first-class concerns rather than afterthoughts.

What You’ll Do

• Own the reliability, performance, and security of our AWS production environment (EC2, ALB, Aurora MySQL, S3, ECS, CloudWatch, SNS, IAM, VPC).
• Design, build, and maintain CI/CD pipelines for PHP/Symfony and React applications, from commit through production promotion, including automated security gates (Aikido) that block vulnerable builds before they ship.
• Stand up and mature our infrastructure-as-code practice - provisioning and configuration currently managed directly, with room to own the migration to a codified, repeatable model.
• Build and tune centralized logging, monitoring, and alerting across CloudWatch and Datadog so issues surface before customers notice them; help drive our ongoing Datadog rollout.
• Manage container workloads (Docker on ECS), including our specialized FreeSWITCH fax/telephony containers.
• Own the infrastructure that our distributed system of independently scaled microservices runs on - per-service ECS auto-scaling, load balancing, and resource right-sizing for both horizontal and vertical scaling. Understand how the stateless services behave and partner closely with engineering on their scaling, deployment, and performance.
• Support database reliability and performance work across Aurora MySQL (read replicas, partitioning, query tuning) and MongoDB.
• Harden the platform against the threat classes relevant to PHI systems, and support ongoing penetration-test remediation.
• Manage secrets, keys, and access across environments (AWS, Symfony secrets vault, Docker secrets, Bitbucket).
• Partner with engineering to improve deployment safety, rollback, and multi-environment (Dev / UAT / Prod) parity.

• Linux server administration, with specific proficiency in Ubuntu 24.04 LTS.
• AWS cloud infrastructure - hands-on production experience with EC2, ALB/ELB, Aurora/RDS MySQL, S3, ECS, CloudWatch, IAM, VPC, and security groups.
• Docker - building, running, and troubleshooting containerized services in a production environment.
• CI/CD pipeline design and maintenance, specifically Bitbucket Pipelines - branching strategy, environment promotion, build/test/deploy stages, and pipeline troubleshooting.
• Bash scripting for automation, system administration, and pipeline support.
• Centralized logging and observability - configuration, aggregation, dashboards, and alerting in AWS CloudWatch and Datadog (we are actively rolling Datadog out; hands-on Datadog experience is a strong plus). Familiarity with ELK stack or Splunk also welcome.
• Web server operations - Apache and PHP-FPM configuration, tuning, and troubleshooting behind a load balancer.
• Database operations support - MySQL (Aurora/RDS) administration, backup/restore, and performance troubleshooting; exposure to MongoDB.
• Secrets and access management - SSH key lifecycle, API token management, and environment-scoped secrets.
• Distributed systems and stateless scaling - strong working understanding of a distributed system of many independently scaled, stateless microservices, and the ability to operate the infrastructure it runs on (auto-scaling policies, load balancing, externalized session/state such as Redis/S3, and resource right-sizing) while partnering with engineering on scaling and deployment.
• SFTP administration and secure file transfer - configuring, hardening, and troubleshooting SFTP servers and automated file exchange with external partners and EHR systems (chroot/jailing, key- and password-based auth, transfer automation, and monitoring).

Security & Compliance (Required)

• Working understanding of operating infrastructure that stores and transmits PHI under HIPAA - encryption at rest and in transit, audit logging, least-privilege access, and network isolation.
• Experience integrating and operating automated security scanning and CI/CD security gates - SAST/DAST, dependency (SCA), container, and IaC scanning, and secrets detection. We use Aikido; equivalent tooling (Snyk, Semgrep, Trivy, etc.) transfers.
• Familiarity with common web application vulnerability classes (IDOR, injection, host header injection, broken cryptography) and their infrastructure-level mitigations.
• Experience supporting audit, penetration-test remediation, or compliance activities.

Preferred / Nice to Have

• Infrastructure-as-code - Terraform and/or Ansible. You would help stand this up from our current state, so demonstrated experience codifying existing infrastructure is highly valued.
• ECS orchestration at scale; Kubernetes experience a plus if we expand orchestration.
• Jenkins or other CI/CD systems beyond Bitbucket Pipelines.
• AWS SNS / notification and messaging infrastructure.
• FreeSWITCH, SIP, or VoIP/telephony experience (we run containerized fax infrastructure).
• Exposure to healthcare / EHR integrations (HL7, NextGen, Athena, Greenway, or similar) or FedRAMP environments.
• PHP / Symfony deployment familiarity - cache management, secrets vault, multi-environment configuration.
• Aurora MySQL performance tuning (read replicas, partitioning, index strategy) and MongoDB queue patterns., Preferred
• Bachelor’s degree in technical discipline or related field, or the equivalent combination of education, training, or work experience., Preferred
• Bachelors or better