Platform Operations Engineer

Simplification & Migration (core mandate)

• Plan and execute zero-downtime migrations of services from AKS/containers to VM-based hosting: systemd unit authoring and service supervision (restart policy, resource limits, sandboxing), Apache, HAProxy and/or nginx as reverse proxy and TLS terminator, certificate automation.

• Build and own the deployment scripts for the target platform: build * test * archive * ship * symlink-flip * health-check * rollback, scripted in bash.

• Preserve two non-negotiable invariants while simplifying everything else: immutable, commit-traceable artifacts and scripted rollback.

• Inventory and retire stale infrastructure: dormant deployments, unused DNS records, orphaned firewall rules, unpinned image tags.

• Maintain host hygiene for consolidated services: OS patching discipline, runtime vendoring, log rotation, centralized log aggregation.

• Familiarity with UptimeKuma, Nagios or similar.

• Operate and migrate data stores: PostgreSQL and/or MySQL.

Network and Infrastructure Operations

• Operate and troubleshoot workloads during the transition, focusing on the networking layer, load balancing, and core platform services.
• Administer the hub network: Azure Firewall rules, VPN gateways, VNet peering, public and private DNS zones and reason about a packet's full path from public IP to service.
• Support the existing release process and network and infrastructure operations until each service is migrated to the new VM-based standard.
• Keep the observability stack healthy (OpenTelemetry, ELK, Grafana, uptime and cost monitoring) and carry its essentials forward to the simplified platform.
• Coordinate cross-cloud dependencies with AWS: DNS/edge routing, queue consumers, and egress IP allowlists.
• L2+ operations support; manage runbooks for external L0, L1 support.

External Integrations & Security

• Own the external integrations most at risk during migration: e-commerce and subscription platforms, messaging/notification providers, and clinical/health-data partners - webhook delivery, signature verification, idempotency, and retry semantics.
• Raise the security baseline as you consolidate: secrets management, webhook authentication, least-privilege network access, and data-retention hygiene. Findings from an internal review are ready for you to remediate; the instinct to spot and close this class of issue - and not create more - is part of the job., * First 30 days: Trace and fix a production issue end-to-end (DNS * firewall * ingress * service * database) with guidance; produce a true-dependency inventory for one candidate service.
• First 90 days: First service migrated off AKS to the VM/systemd platform with a passing rollback drill; firewall rules, DNS zones, and cluster add-ons documented and reproducible; stale-resource inventory complete and retirement underway.
• First 6 months: Migration cadence established with multiple services consolidated; release and rollback drills routine on both platforms; measurable reduction in infrastructure footprint and spend; security-baseline remediations closed.

$130,000 - $150,000 a year

Become part of a team that values your health, growth, and contributions to the health industry.

We believe that transparency in pay is essential to promoting fairness and accountability in our workplace. Therefore, we will provide candidates with the salary range for this position during the interview process. We also welcome and encourage candidates to discuss their compensation expectations with us during this process.

This is a consolidation role for a seasoned systems administrator. The work involves migrating a suite of abstracted services onto a deliberately stable target platform: Linux VMs, systemd-supervised services, Apache, HAProxy, and Nginx routing. You must possess strong Unix knowledge to operate and eventually transform the current stack safely. We are looking for a traditional operations background where success is measured by the removal of unnecessary layers and a genuine bias toward simplicity and host-level stability., * 7+ years operating production Unix/Linux systems, with deep knowledge of systemd, process supervision; Apache, HAProxy

• Strong shell plus one scripting language (bash/Python/PHP) with a track record of building deploy and rollback tooling, not just using it.
• Demonstrated reverse-engineering ability: taking ownership of an undocumented production service and recovering its real dependencies and failure modes.
• Message-queue literacy: Azure Service Bus, SQS, RabbitMQ, or equivalent - ordering, lock/ack semantics, dead-letter handling.
• PostgreSQL operations: replicas/clones, connection proxying, network-restricted access, production diagnostics.
• Working proficiency with Kubernetes and cloud networking - enough to operate private AKS clusters, an Istio-style ingress layer, and Azure firewall/DNS during the transition. We will onboard you on our specifics; deep specialization is not required.
• Migration experience: consolidating or re-platforming production services with zero-downtime cutover and tested rollback.
• A demonstrable record of reducing system surface area - services consolidated, infrastructure retired.
• Clear written communication for runbooks, migration plans, and cross-functional coordination.

Strongly Preferred

• Azure networking at landing-zone depth: hub-spoke VNets, Azure Firewall, Private Link/Private DNS, VPN gateways.
• Administration of external-dns, cert-manager, and policy engines such as Kyverno.
• ELK and OpenTelemetry pipeline operations.
• Webhook-heavy integration experience (e-commerce platforms such as Shopify, subscription billing, marketing/notification platforms, or healthcare data exchanges).
• Experience in a regulated or health-data environment: PHI handling, audit trails, least-privilege network design.
• Terraform or equivalent IaC for cloud network and compute resources.
• Enough AWS to manage cross-cloud seams (Route53, SQS, egress allowlists).
• AI minded; proficient with Claude or similar.