AWS Cloud Platform Engineer

Appnovation; Montreal; On-site; CAD 110,000 - 160,000; Full time

Job summary

Appnovation is hiring AWS Cloud Platform Engineers to build and own the platform’s foundation, including accounts, networking, identity and infrastructure-as-code. You’ll own the path from commit to running agent and collaborate across the team.

Candidates have deep hands-on strength in at least one focus area (Infrastructure & IaC or CI/CD & Runtime Deployment), strong communication, and experience with Terraform, AWS CDK, ECR, IAM, and secure design.

Qualifications

• Deep hands-on strength in at least one focus area (Infra/IaC or CI/CD) with knowledge of the other.
• Clear communication and ability to work in blended client and vendor teams.
• Experience with secrets/config management (AWS Secrets Manager, Parameter Store).
• Strong AWS networking knowledge and secure, least-privilege designs.
• Experience with Terraform and/or AWS CDK/CloudFormation.

Responsibilities

• Build and own the base AWS layer: accounts, networking, identity, and reusable IaC modules.
• Own path from commit to running agent: container builds, pipelines, and runtime deployment.
• Stand up multi-account AWS structure with guardrails and SCPs.
• Design secure VPCs, PrivateLink, and Transit Gateways for internal access.
• Define IAM roles and permission boundaries; implement policy-as-code and security tooling.

Skills

AWS cloud platform

Cloud networking

IAM & least privilege

Terraform / IaC

AWS CDK / CloudFormation

CI/CD pipelines

Docker / container tech

ECR / ECS / EKS / Fargate

Cross-team collaboration

Security & compliance

Tools

Terraform

AWS CDK

CloudFormation

GitHub Actions

GitLab CI

CodePipeline/CodeBuild

Docker

ECR

ECS / EKS / Fargate

Job description

• We’re hiring AWS Cloud Platform Engineers to build and own the platform’s foundation. That means the AWS accounts, networking, identity and infrastructure-as-code everything runs on, plus the path from commit to running agent
• Each engineer will have a main focus in one of the two areas below and work closely across both. This is a named-team engagement, so the person we propose is the person who starts
• Infrastructure & IaC: Build and own the base AWS layer: accounts, networking, identity boundaries, and the reusable IaC modules the rest of the platform is built from
• CI/CD & Runtime Deployment: Own the path from commit to running agent: container builds, Amazon ECR, pipelines, environment promotion, and AgentCore Runtime session configuration
• Stand up the multi-account AWS structure (Organizations, Control Tower or equivalent) with guardrails and service control policies
• Networking: Build secure VPC designs and private connectivity (VPC endpoints, PrivateLink, Transit Gateway) so agent workloads can reach internal systems safely
• Identity Boundaries: Define IAM roles, permission boundaries and least-privilege access for platform services, pipelines and consuming teams
• Reusable IaC Modules: Build and maintain versioned Terraform and/or AWS CDK modules other teams can use with confidence
• Build Pipelines: Design and own CI/CD pipelines that build, test, scan and publish agent containers to Amazon ECR
• Environment Promotion: Automate promotion from dev to test to production with approval gates, rollback and version tracking
• Runtime Deployment: Configure and deploy agents to AgentCore Runtime, including session settings, scaling, config and secrets handling
• Golden Path Templates: Build starter repos and pipeline templates so every new agent is set up and shipped the same way
• Security and Compliance: Build encryption, logging, tagging, image scanning and audit requirements in from the start, working with client security teams
• Documentation and Enablement: Write module docs, decision records and runbooks so the platform doesn’t depend on any one person

Deep hands-on strength in at least one of the two focus areas, and working knowledge of the otherClear communication and comfortable working in a blended client and vendor teamYou think in reusable building blocks and care about the engineers who use them after youExperience with secrets and config management (AWS Secrets Manager, Parameter Store)Solid AWS networking knowledge: VPC design, routing, VPC endpoints, PrivateLink, Transit Gateway and DNSYou write things down so decisions don’t live only in your head6+ years of cloud, platform or DevOps engineering experience, with at least 4 years hands‑on building production AWS environmentsStrong container skills: Docker, Amazon ECR, and deploying to ECS, EKS, Fargate or LambdaDeep understanding of AWS IAM, including cross‑account access, permission boundaries and service control policiesStrong infrastructure‑as‑code skills with Terraform and/or AWS CDK/CloudFormation, including writing reusable modulesPrior experience and connections in the Life Sciences industry is preferredHands‑on experience building CI/CD pipelines (GitHub Actions, GitLab CI, AWS CodePipeline/CodeBuild or similar)You have prior experience in consultingYou automate anything you have to do twiceYou default to secure, least‑privilege designs and can explain whyYou work well inside a client team and build trust quicklyAWS certifications such as Solutions Architect Professional, DevOps Engineer Professional or Advanced NetworkingExperience with Amazon Bedrock, AgentCore Runtime, or deploying LLM/agent‑based applicationsExperience with policy‑as‑code and supply chain security tools (e.g., OPA, Checkov, cosign, SBOM tooling, Amazon Inspector)Experience in pharma, life sciences or another regulated industry with strict security and change control requirements