Cloud Engineer, AWS – CDK, Serverless

This is a fully remote position, open to applicants in Brazil.

📋 Description

• Conduct an inventory of the CDK estate and develop a modernization strategy.

• Upgrade the CDK library/CLI and eliminate deprecated constructs.

• Transition hardcoded context into configuration specific to each environment.

• Merge duplicated stacks into shared constructs while maintaining resource identity.

• Map logical IDs prior to and following the refactoring, ensuring resources remain intact.

• Execute the library upgrade and stack refactor as two distinct, sequential deployments.

• Validate the rollback procedure in both development and testing environments.

• Migrate six Lambda functions from Node 18 to Node 24.

• Address an existing PII logging issue and perform regression testing on each Lambda function.

• Reassess the WAF, mutual TLS domain, truststore, X-Ray tracing, and upstream timeouts.

• Collaborate with the customer's POS team across six external callers.

• Establish development, testing, and production deployment pipelines with OIDC federation, approval gates, and a ServiceNow change step.

• Integrate CDK assertion tests, drift detection, and API access log retention.

• Publish the SQS queue ARN and KMS key ARN through Parameter Store.

• Allow send permissions to the downstream Terraform-managed system.

• Ensure naming, tagging, and documentation align with the customer's internal standards.

• Record identity-preservation decisions for future engineers.

⛳️ Requirements

• Over 5 years of experience with AWS, including more than 3 years in infrastructure-as-code.

• Practical experience with AWS CDK in TypeScript — including construct trees, logical ID derivation, and the implications of changes in construct paths.

• Genuine experience with CloudFormation resource identity: stack refactoring, logical ID overrides, cdk diff against deployed state, and drift detection.

• Familiarity with Terraform — comfortable operating at the intersection of CDK and Terraform.

• Strong background in AWS serverless technologies: Lambda, API Gateway (REST), SQS and DLQs, Parameter Store, KMS, and Secrets Manager.

• Experience with AWS edge and security services — WAF web ACLs, mutual TLS custom domains and truststores, and cross-account/cross-boundary IAM.

• Hands-on experience migrating Node.js runtimes (e.g., Node 18 to 24), covering dependency and deprecation handling.

• Experience in CI/CD pipeline setups with OIDC federation and approval gates (GitHub Actions or equivalent).

• Knowledge of observability tools — X-Ray, CloudWatch metrics and alarms, and log retention.

• Ability to communicate effectively with non-engineers and adapt when project scope is still being defined.

• Proficient in English (C1 level) for daily client interactions.

🏝️ Benefits

• Hourly contractor engagement.

• 100% remote work.

• Estimated project duration of 6–8 weeks.