Note: The job is a remote job and is open to candidates in USA. MaxiCare is an AI-native electronic medical records platform for skilled nursing and assisted living facilities. The Senior AWS Systems Administrator owns the AWS environment end to end, including networking, security, identity, compute, data services, backups, monitoring, infrastructure as code, cost management, and incident response for a HIPAA-regulated platform handling PHI.
Responsibilities
- AWS accounts and organization. AWS Organizations, account structure, service control policies, the landing zone, and the separation between production, staging, and development
- Networking and connectivity. The heart of the seat. VPC design, subnets, route tables, security groups, NACLs, and Transit Gateway topology. You build site to site VPN tunnels and Transit Gateway attachments that let facility and integration partners reach MaxiCare without exposing PHI to the public internet. You can explain BGP on a whiteboard and have configured customer gateways for all kinds of edge devices
- Secure cross organization tunneling for PHI. You design the tunnels, configure the encryption, document what flows where, and defend it to a compliance auditor. When a new facility partner integrates, you walk their network team through the connection plan and get it working
- Compute and data. EC2 fleets, Aurora PostgreSQL, RDS, DynamoDB, ElastiCache, and the MSK Kafka event spine. Capacity planning, scaling, patching, and broker health. You know what to do when Aurora misbehaves at 3 AM or Kafka consumer lag starts climbing
- DNS and certificates. Route 53 zones, records, and routing rules. ACM certificates, renewal automation, and the certificate inventory
- Identity, access, and Microsoft Entra ID. IAM and its bridge to the company directory. Conditional Access, MFA enforcement, SSO federation into AWS IAM Identity Center, SCIM provisioning into GitHub Enterprise Managed Users and the rest of the SaaS stack, and least privilege as it plays out in a real organization. You can answer who has access to what without a spreadsheet
- Microsoft 365 administration. You run the tenant. Exchange Online, SharePoint, Teams, OneDrive, and license assignments. Group membership drives access, not hand granted permissions. Retention, sharing rules, and licensing all sit inside the same HIPAA boundary as the platform
- Workforce and contractor provisioning. Onboarding means an Entra ID identity, group membership, NordLayer, a GitHub EMU seat, IAM Identity Center entitlement, MaxiCare application access, MFA enrollment, and a hardware security key where required. Offboarding means revoking all of it cleanly, on time, with audit evidence
- Business continuity and backups. You watch AWS Backup jobs across Aurora, RDS, DynamoDB, EBS, and S3 every day. You run restore drills on a defined cadence. You back up configuration state, including CDK or Terraform state, Route 53 zones, IAM policies, AWS Config snapshots, and the secrets inventory, so the platform can be rebuilt from code rather than tribal memory. You own the recovery time and recovery point objectives and can prove the platform meets them
- Monitoring and alerting. CloudWatch dashboards, alarms, log aggregation, and SNS notifications that page the right person at the right time. Billing alarms that catch a runaway resource early. Performance alerts that fire before a clinician notices latency
- Security and audit. CloudTrail, AWS Config, GuardDuty, Security Hub, KMS keys with rotation and usage logging, Secrets Manager, and Parameter Store. You can produce HIPAA audit evidence without scrambling for two days
- Infrastructure as code. Click ops is not part of this seat. Changes live in version control and ship through a pipeline. AWS CDK in TypeScript is the current stack. Terraform translates
- Cost and capacity. You watch the bill, set the budgets, and bring cost problems to the team with a recommendation rather than a complaint
- Incident response. You are on the pager rotation, you write the runbooks, and you lead the response and the post mortem
- Other duties as assigned. This is an early stage company. You go where the work is
Skills
- Seven or more years administering production AWS, including senior time where you owned outcomes rather than implemented someone else's design
- Deep production experience with VPC design, Transit Gateway, site to site VPN, and customer gateways
- You have built and maintained tunnels between AWS and on premises partner networks
- You have administered AWS environments handling PHI
- You know what a BAA scope looks like in practice, where the encryption boundaries sit, and what an auditor will ask for
- Scaling, parameter tuning, backups, point in time recovery, read replicas, and failover
- You have been through a real outage and can describe what you did
- Scheduled backups, real restore drills, and recovery from a real incident
- You can describe a restore you performed, what failed, and what you fixed
- Expert command of roles, policies, cross account access, identity providers, SSO, MFA, and access boundaries
- Production experience with Conditional Access, MFA, SCIM provisioning, the account lifecycle from onboarding through offboarding, and Exchange, SharePoint, Teams, and license management
- You have run a directory, not just inherited one
- Zone design, routing policies, health checks, and failover patterns
- You can explain TCP, BGP, IPsec, TLS, and DNS without a search engine, and you can troubleshoot when a packet does not arrive
- Real production experience with systemd, the network stack, and logs
- AWS CDK in TypeScript, Terraform, or comparable
- CloudWatch, log aggregation, distributed tracing, and alerting that does not cry wolf
- Daily use of AI for operations work, documentation, runbooks, and incident analysis
- Anthropic Claude in particular
- You have carried a real production pager and can teach good incident response
- A four year degree from an accredited institution, or demonstrated engineering depth that makes a degree unnecessary
- Fully remote, across time zones
- A few hours of overlap with US Central time on most working days
- Some change windows happen overnight US time
- Occasional, for facility partner network setup, integration testing, or a team gathering
- You are the primary infrastructure escalation in the rotation
- The system runs in real facilities around the clock
- AWS administration on an EMR, EHR, or healthcare platform
- Bonus for skilled nursing or assisted living experience
- Time on a team that took a product through a HITRUST, SOC 2, or ONC audit
- AWS Direct Connect for partner connectivity
- Control Tower, account vending, and SCP design at scale
- AWS Solutions Architect Professional, Advanced Networking Specialty, or Security Specialty
- The depth matters more than the certificate
- NordLayer, Tailscale, ZeroTier, or comparable VPN platforms in a HIPAA context
- Multi region disaster recovery you have designed, tested, and failed over for real
- GitHub Enterprise Managed Users with Entra ID OIDC and SCIM
- Python, Bash, or TypeScript scripting beyond IaC
- Clear written and spoken English
- Native fluency is not required. Most team communication is asynchronous and written
Benefits
- Fully remote, across time zones.
- An opportunity for an annual performance bonus tied to individual and company results.
Company Overview