Cloud Engineer AWS ( CDK / Serverless) ( 102-09SENG-01 )

Role overview This is a six-to-eight week, fully remote, hourly contract for an AWS infrastructure engineer. The work is careful production surgery on a live serverless gateway with active external consumers: modernizing a CDK estate, hardening the security perimeter, and handing off a clean integration point for a downstream Terraform build.

Responsibilities - Inventory the existing CDK estate and produce a modernization plan covering library/CLI upgrades, deprecated constructs, and environment-specific configuration - Consolidate duplicated stacks into shared constructs while preserving CloudFormation resource identity, with logical IDs mapped before and after - Run the library upgrade and the stack refactor as two sequenced, ordered deployments with a tested rollback path - Migrate six Lambda functions from Node 18 to Node 24, close an open PII logging finding, and regression-test each handler - Re-verify the security perimeter after both deployments, including WAF web ACLs, mTLS custom domain and truststore, X-Ray tracing, and upstream timeouts, working alongside the customer's POS team across six external callers - Build deployment pipelines for dev, test, and prod with OIDC federation, approval gates, a ServiceNow change step, CDK assertions, drift detection, and API access log retention - Publish the SQS queue ARN and KMS key ARN via Parameter Store and grant send permission to the downstream Terraform-managed system as the key ordering dependency for that team's build - Align naming, tagging, and documentation with internal standards, capturing identity-preservation decisions clearly enough for the next engineer

Requirements - At least five years with AWS and three years working in infrastructure-as-code - Hands-on AWS CDK experience in TypeScript, including construct trees, logical ID derivation, and the consequences of construct path changes - Real experience with CloudFormation resource identity, stack refactoring, logical ID overrides, cdk diff against deployed state, and drift detection - Working Terraform knowledge and comfort operating across a CDK/Terraform boundary - Solid AWS serverless background: Lambda, API Gateway (REST), SQS and DLQs, Parameter Store, KMS, and Secrets Manager - Experience with AWS edge and security services, including WAF web ACLs, mutual-TLS custom domains and truststores, and cross-account IAM - Practical experience migrating Node.js runtimes, including dependency and deprecation handling - CI/CD pipeline experience with OIDC federation and approval gates, such as GitHub Actions - Working knowledge of observability tooling: X-Ray, CloudWatch metrics, alarms, and log retention - Clear communication with non-engineers and fluency in English at C1 level

Benefits and work setup - Hourly contractor engagement, 100% remote - Estimated duration six to eight weeks - Time zone expected to align with EST or MST