Job Role: AWS Infrastructure Engineer
Location: Boston MA, Arlington, VA, Atlanta GA, Austin TX, Chicago, IL, Cleveland OH
Experience: 10 Years
Skills:
Lead cloud infrastructure architecture design for DTCC A3P landing zone migration supporting FICC (Fixed Income, Currency, and Commodities) workloads. Design multi-region AWS infrastructure including VPC architecture, self-managed OpenShift on EC2, Aurora Global Database, DynamoDB Global Tables, and IBM MQ RDQM clustering. Architect disaster recovery topology with F5 GTM integration, cross-region data replication, and hybrid connectivity (Direct Connect/VPN) for on-premises integration. Define Terraform IaC modules for enterprise-scale, multi-account deployments with cost governance and Tier 1 resiliency requirements.
Role Scope & Key Responsibilities
Primary Responsibilities:
- Landing Zone Architecture: Design and validate DTCC A3P landing zone configuration for FICC workloads with AWS Organizations, SCPs, and multi-account governance
- Network Design: Define VPC architecture with public/private subnets, VPC endpoints, security groups per SYS ID; configure multi-region topology (us-east-1 primary, us-east-2 standby)
- Disaster Recovery: Design F5 GTM integration for DR failover and operational traffic rotation; architect cross-region data replication (SRDF-A equivalent, Aurora Global DB, DynamoDB Global Tables)
- Infrastructure as Code: Define Terraform module structure for FICC infrastructure (OCP on EC2, Aurora, DynamoDB, IBM MQ, Global Scape, Autosys)
- Compute Architecture: Design EC2 instance sizing and placement for OCP worker nodes, Autosys server, Global cape SFTP, IBM MQ RDQM with HA configurations
- Observability: Configure Dynatrace One Agent deployment on OCP and Splunk log forwarding
- Hybrid Connectivity: Define on-premises connectivity architecture (Direct Connect/VPN for Ping Federate, CRS, CDTS MQ, Venafi)
- Cost Governance: Design tagging strategy (per SYS ID, per environment, per wave) and validate A3P platform service readiness
Key Deliverables:
- A3P Landing Zone Design (FICC-specific)
- VPC and Network Architecture (multi-region)
- Terraform Module Catalog (OCP, Aurora, DynamoDB, MQ, GlobalScape, Autosys)
- Multi-Region DR Infrastructure Design
- On-Premises Connectivity Architecture
EC2 Sizing Recommendations
AWS Skills & Services
Governance & multi-account:
- AWS Organizations: OU structure, SCPs, consolidated billing, cross-account strategies
- AWS Control Tower: Landing zone automation, guardrails, Account Factory
- AWS Service Catalog: Standardized resource provisioning
Networking:
- Amazon VPC: Advanced design (public/private subnets, VPC endpoints, security groups, NACLs, route tables)
- AWS Transit Gateway: Hub-and-spoke architecture, multi-region peering
- AWS Direct Connect: Hybrid connectivity, VIFs, LAG configurations
- AWS VPN: Site-to-Site VPN for on-premises integration
- Elastic Load Balancing: ALB/NLB for OCP ingress, F5 GTM integration patterns
- Amazon Route 53: DNS management, health checks, failover routing
Compute & Containers:
- Amazon EC2: Instance families (compute/memory/storage optimized), placement groups, Auto Scaling, self-managed infrastructure
- OpenShift on EC2: Overlay networks, load balancers, ingress controllers, persistent storage (EBS/EFS)
Database & Storage:
- Amazon Aurora: Global Database (cross-region replication), cluster endpoints, failover mechanisms
- Amazon DynamoDB: Global Tables, on demand/provisioned capacity, DAX caching
- Amazon S3: Bucket policies, lifecycle policies, cross-region replication, versioning
- Amazon EBS: Volume types, snapshots, encryption, cross-region copy
- Amazon EFS: Shared file storage for OCP persistent volumes
Messaging & Integration:
- IBM MQ RDQM on EC2: Clustering, HA configurations, mTLS, channel authentication
- Amazon MQ: Managed message broker (if applicable for non-RDQM workloads)
Disaster Recovery:
- AWS Backup: Centralized backup, cross-region/cross-account backup
- AWS Elastic Disaster Recovery (DRS): Continuous replication, failover orchestration
- F5 GTM Integration: DNS-based traffic management, health monitoring
Monitoring & Observability:
- Amazon CloudWatch: Metrics, logs, alarms, dashboards
- AWS X-Ray: Distributed tracing
- Dynatrace OneAgent: APM integration with OCP
- Splunk: Log forwarding and SIEM integration
Security & Compliance:
- AWS IAM: Advanced policies, cross-account roles, service accounts
- AWS KMS: Customer Managed Keys, key policies, cross-region replication
- AWS Secrets Manager: Credential rotation, cross-account access
- AWS Security Hub: Centralized security findings
- AWS Config: Configuration compliance, resource inventory
Infrastructure as Code:
- Terraform: Enterprise-scale IaC (multi-account, multi-region), module development, state management, workspaces
- AWS CloudFormation: Stack Sets for multi-account deployments
Cost Management:
- AWS Cost Explorer: Cost analysis, tagging strategies
- AWS Budgets: Cost alerts, anomaly detection
- Tagging Strategy: Per SYS ID, per environment, per wave
Hybrid Connectivity:
- AWS Direct Connect: Dedicated network connections, VIFs, LAG
AWS VPN: Site-to-Site VPN for Ping Federate, CRS, CDTS MQ, Venafi integration
Financial Services & Industry Skills
- Large regulated financial-services delivery with formal change-control, audit and risk governance
- Operational resilience expectations including RTO/RPO, multi-region DR and evidence for audit review
- Awareness of applicable controls and regulations such as DORA, NIST CSF 2.0, PCI DSS, SEC cyber rules, RegSCI and SIFMU/FMI expectations where relevant
- Ability to create Tech Risk-ready documentation including ADRs, runbooks, design docs, threat models and validation evidence
- Clear communication with client engineering, security, SRE, data and platform stakeholders as an embedded SME
Certifications / Qualifications
- AWS Certified Solutions Architect - Associate / Professional
- AWS Certified SysOps Administrator - Associate
- AWS Certified DevOps Engineer - Professional preferred
