Cloud Engineer AWS ( CDK / Serverless) ( 102-09SENG-01 )

About this role

This role modifies a live serverless gateway in production — no downtime, no change in behaviour — leaving a clean handoff point for a downstream build managed in Terraform. This is careful surgery on production infrastructure with active external consumers, not a greenfield build. The scope includes modernizing a CDK estate made up of four stacks, six Lambda functions, a WAF web ACL, an mTLS custom domain/truststore, and a REST API — preserving resource identity during consolidation and coordinating two sequenced deployments with a tested rollback path.

What you will do Inventory the CDK estate and build a modernization plan: upgrade the CDK library/CLI, replace deprecated constructs, move hardcoded context into per-environment config. Consolidate duplicated stacks into shared constructs without losing resource identity — map logical IDs before and after, pick a preservation method, and confirm nothing gets replaced before touching production. Run the library upgrade and the stack refactor as two separate, ordered deployments, with a rollback path tested in dev and test first.

Migrate all six Lambda functions from Node 18 to Node 24, close an open PII logging finding, and regression-test each one. Re-verify the security perimeter after both deployments — WAF, the mTLS domain and truststore, X-Ray tracing, upstream timeouts — working directly with the customer's POS team across all six external callers. Build deployment pipelines for dev/test/prod with OIDC federation, approval gates, and a ServiceNow change step.

Add CDK assertion tests, drift detection, and API access log retention. Publish the SQS queue ARN and KMS key ARN via Parameter Store, and grant send permission to the downstream Terraform-managed system — this is the key ordering dependency for that team's build. Align naming, tagging, and documentation with the customer's internal standards, and document your identity-preservation decisions clearly enough for the next engineer to follow.

Requirements 5+ years with AWS, including 3+ years working in infrastructure-as-code. Hands-on AWS CDK experience in TypeScript — construct trees, logical ID derivation, and what happens when a construct path changes. Real experience with CloudFormation resource identity: stack refactoring, logical ID overrides, cdk diff against deployed state, drift detection. Working Terraform knowledge — comfortable operating across the CDK/Terraform boundary.