Position Title: RQ00813 - Senior DevOps / Cloud Engineer
Location: Toronto, ON
Mode: Contract
Position Summary
A successful candidate will be responsible for designing, provisioning, automating, deploying, operating, and troubleshooting AWS cloud infrastructure and CI/CD pipelines supporting application, integration, data-processing, and frontend components.
The resource will develop and maintain GitHub Actions workflows and AWS Cloud Development Kit (AWS CDK) infrastructure to enable secure, reliable, and repeatable deployments across multiple environments. The role involves hands-on implementation and support of AWS services, including AWS Glue, Amazon Data Firehose, AWS Database Migration Service (DMS), Amazon ECS on AWS Fargate, Amazon ECR, Amazon S3, Amazon CloudFront, AWS WAF, and EC2 Auto Scaling groups.
The successful candidate must demonstrate strong expertise in cloud infrastructure automation, container orchestration, AWS networking, identity and access management, encryption, monitoring, and production troubleshooting. Particular emphasis will be placed on diagnosing AWS Glue networking issues, including subnet selection, security groups, Elastic Network Interface (ENI) creation, DNS resolution, routing, and private connectivity to data sources and targets.
The resource will collaborate with architecture, development, data, security, privacy, quality assurance, and operations teams to ensure the OCRE platform meets its infrastructure, security, availability, and operational requirements.
Key Responsibilities
1. CI/CD Automation and Infrastructure as Code
- Design, develop, and maintain GitHub Actions workflows for building, testing, scanning, packaging, deploying, and promoting application and infrastructure changes.
- Implement secure deployment pipelines incorporating environment approvals, artifact controls, rollback procedures, and authentication to AWS.
- Develop and maintain AWS CDK applications, reusable constructs, stacks, configuration, and deployment assets.
- Implement infrastructure testing, configuration validation, deployment reviews, and CloudFormation troubleshooting.
- Support multi-environment infrastructure provisioning and ensure deployments are repeatable, secure, and maintainable.
2. AWS Cloud Infrastructure and Data Services
- Provision, configure, and maintain AWS Glue jobs, connections, triggers, IAM roles, encryption settings, and network access.
- Troubleshoot AWS Glue connectivity issues involving ENI creation, subnet capacity, DNS, routing, security groups, NAT gateways, and VPC endpoints.
- Provision and support Amazon Data Firehose delivery streams and AWS DMS replication infrastructure, including endpoints, subnet groups, tasks, table mappings, logging, and monitoring.
- Configure and maintain Amazon S3 resources, Amazon CloudFront distributions, and AWS WAF policies for secure frontend delivery.
- Manage certificates, DNS configurations, cache policies, response headers, access controls, and deployment invalidations.
3. Containerization and Compute Infrastructure
- Deploy, configure, operate, and troubleshoot Docker workloads on Amazon ECS using AWS Fargate.
- Manage Amazon ECR repositories, container images, task definitions, ECS services, secrets, load balancers, target groups, health checks, and logging.
- Configure service scaling, resource limits, monitoring, and container runtime diagnostics.
- Maintain EC2 launch templates and Auto Scaling groups, including AMIs, bootstrap scripts, instance profiles, scaling policies, patching, health checks, and lifecycle management.
- Diagnose deployment failures, instance replacement issues, container failures, and infrastructure performance problems.
4. AWS Networking and Security
- Design and maintain VPCs, public and private subnets, route tables, NAT gateways, VPC endpoints, network ACLs, security groups, and DNS configurations.
- Establish and troubleshoot secure connectivity between OCRE workloads, AWS services, and dependent data sources and targets.
- Implement least-privilege IAM roles and policies, AWS KMS keys and key policies, encryption controls, and secrets integration.
- Ensure secure authentication and authorization for deployment pipelines and application workloads.
- Apply security, privacy, auditability, and access-control practices appropriate for regulated healthcare and public-sector environments.
5. Monitoring, Troubleshooting, and Operational Support
- Implement and maintain Amazon CloudWatch logs, metrics, dashboards, alarms, and operational monitoring.
- Support incident investigation, root-cause analysis, infrastructure diagnostics, defect resolution, and production recovery.
- Maintain deployment records, validation evidence, operational procedures, and troubleshooting documentation.
- Support service reliability, availability, resilience, backup, recovery, and production-readiness requirements.
- Collaborate with development and operations teams to resolve infrastructure and deployment issues.
6. Technical Documentation and Knowledge Transfer
- Prepare and maintain infrastructure designs, AWS CDK documentation, deployment pipeline documentation, network diagrams, configuration records, and operational runbooks.
- Document deployment procedures, security controls, testing evidence, incident diagnostics, and recovery processes.
- Participate in code reviews, design walkthroughs, interface and data-mapping reviews, demonstrations, release reviews, and operational-readiness assessments.
- Provide ongoing knowledge transfer to Ontario Health’s OCRE team throughout the engagement.
- Support the documentation and handover of Java/Spring Boot services, HAPI FHIR processing, NextGen Connect channels, HL7 v2 and FHIR mappings, Ontario HRM Standard implementation details, Pub/Sub integration, ReactJS components, security configurations, and Docker deployment procedures.
- Ensure source code, configuration, tests, technical documentation, runbooks, and lessons learned are shared with Ontario Health stakeholders before the engagement concludes.
Mandatory Qualifications and Required Experience
Candidates must demonstrate senior-level, hands-on experience in the following areas:
1. GitHub Actions and AWS CDK
- Extensive experience developing GitHub Actions workflows for application and infrastructure deployment.
- Experience implementing secure AWS authentication, reusable workflows, testing, environment promotion, approvals, rollback, and deployment troubleshooting.
- Strong experience with AWS CDK and infrastructure as code using JavaScript and Python, including reusable constructs, stack composition, configuration, testing, synthesis, and deployment.
- Experience with AWS CloudFormation deployment, troubleshooting, and multi-environment configuration.
2. Amazon ECS, AWS Fargate, Docker, and EC2
- Strong experience deploying and operating containerized applications using Docker, Amazon ECS, AWS Fargate, and Amazon ECR.
- Experience managing task definitions, services, load balancing, scaling, health checks, secrets, logging, and resource allocation.
- Hands-on experience with EC2 launch templates and Auto Scaling groups, including bootstrap configuration, scaling policies, instance health, patching, and failure recovery.
3. AWS Networking and Security
- Extensive experience with VPCs, subnets, routing, NAT gateways, VPC endpoints, DNS, security groups, network ACLs, IAM, and AWS KMS.
- Strong understanding of encryption, secure access controls, secrets management, and least-privilege permissions.
- Demonstrated ability to troubleshoot AWS Glue networking and private connectivity issues involving ENIs, subnet selection, DNS, routing, security groups, and service endpoints.
4. AWS Data and Frontend Services
- Hands-on experience provisioning and supporting AWS Glue, Amazon Data Firehose, AWS DMS, Amazon S3, Amazon CloudFront, and AWS WAF.
- Experience configuring service connectivity, encryption, logging, monitoring, access controls, and deployment dependencies.
- Experience supporting production cloud infrastructure and resolving service availability, deployment, and connectivity issues.
5. Public-Sector Experience
- Previous experience working on public-sector projects is mandatory.
- Experience supporting regulated healthcare or public-sector workloads, including privacy-aware logging, encryption, auditability, change management, resilience, and production support, is highly desirable.
Desired Skills and Additional Qualifications
The following skills will be considered assets:
- Experience implementing GitHub OpenID Connect (OIDC) federation with AWS.
- Experience with protected GitHub environments, reusable workflows, deployment approvals, artifact controls, and least-privilege pipeline roles.
- Familiarity with Java and JavaScript build tooling, AWS CDK unit testing, infrastructure policy validation, cdk diff, CloudFormation change sets, and drift detection.
- Experience with Amazon CloudWatch, AWS CloudTrail, AWS Config, AWS Systems Manager, AWS Secrets Manager, Amazon Route 53, and AWS Certificate Manager.
- Familiarity with security monitoring, operational readiness, incident response, and infrastructure recovery procedures.
- Experience with healthcare interoperability technologies, including HL7 v2, FHIR, HAPI FHIR, NextGen Connect, and Ontario HRM standards.
- Strong analytical, troubleshooting, documentation, communication, and stakeholder collaboration skills.
Key Deliverables
The successful candidate will be expected to deliver the following:
- CI/CD Pipelines: Reusable GitHub Actions workflows for build, test, security scanning, packaging, infrastructure provisioning, application deployment, environment promotion, approvals, and rollback.
- AWS CDK Infrastructure: Maintainable CDK applications, stacks, constructs, tests, configuration, and deployment assets defining the assigned OCRE cloud infrastructure.
- AWS Glue Infrastructure: Configured Glue jobs, connections, triggers, IAM roles, encryption, networking, and validated private connectivity to required data sources and targets.
- Data Integration Services: Amazon Data Firehose and AWS DMS infrastructure, including endpoints, subnet groups, tasks, table mappings, delivery configurations, logging, monitoring, and operational documentation.
- Container Platform: Amazon ECS on AWS Fargate deployment assets, including ECR integration, task definitions, services, scaling, load balancing, secrets, health checks, logging, and troubleshooting procedures.
- Frontend Infrastructure: Secure frontend hosting and delivery using Amazon S3, CloudFront, and AWS WAF, including certificates, DNS, cache and response-header policies, access controls, and invalidation procedures.
- Networking and Security Components: VPCs, subnets, routing, NAT gateways, VPC endpoints, DNS, security groups, IAM policies, AWS KMS keys, encryption, and secrets integration.
- Compute Infrastructure: EC2 launch templates and Auto Scaling group configurations, scaling and health policies, bootstrap and patching procedures, monitoring, and failure-recovery documentation.
- Monitoring and Operational Readiness: CloudWatch logs, metrics, dashboards, alarms, deployment records, infrastructure tests, validation evidence, incident diagnostics, and operational runbooks.
- Technical Documentation and Knowledge Transfer: Technical designs, infrastructure diagrams, network and security configuration records, release documentation, defect fixes, demonstrations, production support, and comprehensive knowledge-transfer materials.
