AWS Architect

Avance Consulting; Polska; Presencial; PLN 393.000 - 568.000; Jornada completa

Descripción de la vacante

Avance Consulting seeks an experienced AWS-focused engineer to build a PoV for a complex data platform. You will design the VPC, subnets, routing, and security groups, and implement DMS for MongoDB CDC with full load and ongoing replication.

The role includes routing DMS output into Kinesis, writing to S3 as an immutable log, and building a governance-compliant event store. You will also implement RDS PostgreSQL as the ledger, DynamoDB for audit, and use Secrets Manager and KMS for secure key

Formación

• Strong experience architecting AWS-based PoV environments with secure outbound controls.

Responsabilidades

• Build and configure AWS PoV environment (VPC, subnets, routes, SGs).
• Implement AWS DMS for MongoDB CDC, including full load and ongoing replication.
• Configure DMS endpoints, replication task, checkpointing and latency monitoring.
• Route DMS output into Kinesis Data Streams as the single event log.
• Write immutable raw change history to S3 via Kinesis Firehose with Object Lock.
• Build S3 event store with governance and replay-ready storage.
• Implement PostgreSQL RDS as the financial ledger target and DynamoDB as audit.
• Use Secrets Manager for credential storage and access control.
• Use KMS CMKs for RDS, DynamoDB, S3, Kinesis, Secrets Manager and signing.
• Configure CloudWatch logs/metrics for DMS, pgAudit, alarms and evidence.
• Enable VPC Flow Logs to prove compliant traffic paths.
• Define VPN transport as primary path, with controlled fallback.
• Create CloudWatch alarms, EventBridge rules and Step Functions for CDC control.
• Develop Lambda guard for canary reads, roles, oplog headroom and DMS latency.
• Run reconciliation and replay workloads on ECS Fargate, orchestrated by Step Functions.
• Run JMeter load tests against MongoDB replica set via ECS Fargate.
• Capture DMS lag, JMeter throughput and latency metrics in CloudWatch.
• Implement multi-tenant isolation with tenant IAM and DynamoDB LeadingKeys.
• Correlate isolation tests with CloudTrail and pgAudit logs.
• Use Terraform 1.5+ for all provisioning and GitHub Actions with OIDC for deploys.
• Store Terraform state remotely with locking and provide zero-drift teardown evidence.

Conocimientos

AWS

DMS

Kinesis

S3

RDS PostgreSQL

DynamoDB

Terraform

GitHub Actions

ECS Fargate

EventBridge

Herramientas

MongoDB

CloudWatch

KMS

Athena

Glue

OpenSearch

Descripción del empleo

Build and configure the AWS PoV environment, including VPC, subnets, route tables, security groups and controlled outbound paths.

• Implement AWS DMS for MongoDB CDC, including full load and ongoing change replication from the named secondary.
• Configure DMS endpoints, replication task, checkpointing, CDC latency monitoring and recovery procedures.
• Use AWS DMS to capture ActionEntry, Transaction, Movement and related in-scope collections.
• Route DMS output into Amazon Kinesis Data Streams as the single event log.
• Use Amazon Kinesis Firehose to write immutable raw change history into the S3 event store.
• Build an Amazon S3 event store with Object Lock governance mode, retention controls and replay-ready storage.
• Implement PostgreSQL RDS as the financial ledger target.
• Implement Amazon DynamoDB as the audit target, including single-table design, tenant-scoped keys, on-demand capacity and PITR.
• Use AWS Secrets Manager to store and control access to the read-only MongoDB CDC credential.
• Use AWS KMS customer-managed keys for RDS, DynamoDB, S3, Kinesis, Secrets Manager, pseudonymisation and report signing.
• Configure CloudWatch logging and metrics for DMS, pgAudit logs, tunnel status, alarms and operational evidence.
• Use VPC Flow Logs to evidence that MongoDB traffic only traverses the approved path.
• Implement AWS Site-to-Site VPN as the preferred encrypted transport path between AWS and the Hetzner private network.
• Define fallback direct controlled access if the VPN path is not available by the required P0 timeline.
• Build CloudWatch alarms, EventBridge rules and Step Functions workflows to suspend CDC automatically when source-impact thresholds are breached.
• Implement a Lambda-based source-impact guard to monitor canary reads, member role, oplog headroom and DMS latency.
• Run reconciliation workloads as containerised Python jobs on ECS Fargate, orchestrated by Step Functions and scheduled by EventBridge Scheduler.
• Run replay tooling as ECS Fargate batch jobs using S3 event-store data and RDS isolated replay schemas.
• Run JMeter load-testing harness on ECS Fargate against the ReThink-IT-provided MongoDB 5.0 replica set.
• Capture DMS lag, JMeter throughput and synthetic-event latency metrics through CloudWatch.
• Implement cross-tenant isolation using tenant-specific IAM roles and DynamoDB LeadingKeys conditions.
• Correlate isolation test cases with CloudTrail, DynamoDB data events and PostgreSQL pgAudit logs.
• Use Terraform 1.5+ for all AWS infrastructure provisioning.
• Use GitHub Actions with OIDC to deploy AWS infrastructure with protected environments, PR plans and apply-on-merge controls.
• Store Terraform state remotely with locking.
• Produce CloudTrail-derived reports proving zero manual AWS console-originated mutations.
• Build Athena-based reporting over CloudTrail logs for deployment evidence.
• Create Glue catalogue and Athena-queryable AI-ready export over partitioned Parquet data in S3.
• Implement S3 quarantine prefixes and alarms for non-conforming events.
• Build OpenSearch projection as an optional P3 component, with fallback to MongoDB and destruction after testing.
• Maintain AWS evidence artefacts including transport-security packs, reconciliation reports, event-loss reports, replay logs, lag reports, CloudTrail reports and teardown evidence.
• Perform AWS teardown and provide empty inventory, zero-billing and destruction confirmation evidence.
• Manage the AWS infrastructure cost envelope, including the Site-to-Site VPN cost within the stated EUR 150/month estimate.