Cloud Engineer AWS ( CDK / Serverless)

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Cloud Engineer AWS (CDK / Serverless) based in Brazil. This role focuses on modernizing and safely evolving a live AWS serverless environment supporting active external consumers. You will work hands-on with AWS CDK, CloudFormation, Terraform, Lambda, API Gateway, security services, and CI/CD infrastructure. The position requires careful infrastructure changes that preserve existing resource identity, application behavior, and production availability. You will lead a structured modernization effort across multiple infrastructure stacks and serverless components. Security, observability, deployment reliability, and rollback planning are central to the work. You will also coordinate closely with technical stakeholders and ensure the environment is clearly documented for future development. This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Cloud Engineer AWS (CDK / Serverless) based in Brazil. This role focuses on modernizing and safely evolving a live AWS serverless environment supporting active external consumers. You will work hands-on with AWS CDK, CloudFormation, Terraform, Lambda, API Gateway, security services, and CI/CD infrastructure. The position requires careful infrastructure changes that preserve existing resource identity, application behavior, and production availability. You will lead a structured modernization effort across multiple infrastructure stacks and serverless components. Security, observability, deployment reliability, and rollback planning are central to the work. You will also coordinate closely with technical stakeholders and ensure the environment is clearly documented for future development. Accountabilities: Inventory the existing AWS CDK estate and develop a modernization plan, including CDK library and CLI upgrades, deprecated construct replacements, and environment-specific configuration. Consolidate duplicated CDK stacks into shared constructs while preserving existing resource identity and preventing unintended resource replacement. Map logical IDs before and after refactoring and validate infrastructure changes using tools such as CDK diff and drift detection. Execute the modernization through two separate, sequenced deployments with rollback procedures tested in development and test environments before production changes. Migrate six Lambda functions from Node.js 18 to Node.js 24, address an identified PII logging issue, and perform regression testing for each function. Re-validate the security perimeter, including WAF, mTLS custom domains and truststores, X-Ray tracing, and upstream timeouts. Collaborate with the customer's POS team and coordinate technical requirements across six external callers. Build CI/CD pipelines for development, test, and production environments using OIDC federation, approval gates, and ServiceNow change-management steps. Implement CDK assertion tests, infrastructure drift detection, and API access-log retention. Publish SQS queue and KMS key ARNs through Parameter Store and configure the required permissions for the downstream Terraform-managed system. Align infrastructure naming, tagging, and documentation with internal standards and clearly document resource-identity preservation decisions and modernization changes. Requirements: 5+ years of experience working with AWS, including at least 3 years focused on infrastructure as code. Strong hands-on experience with AWS CDK and TypeScript, including construct trees, logical ID derivation, and the impact of construct-path changes. Proven experience with CloudFormation resource identity, stack refactoring, logical ID overrides, CDK diff, deployed-state comparison, and drift detection. Working knowledge of Terraform and experience operating across CDK and Terraform environments. Strong AWS serverless experience with Lambda, API Gateway REST, SQS/DLQs, Parameter Store, KMS, and Secrets Manager. Experience with AWS edge and security services, including WAF web ACLs, mutual-TLS custom domains and truststores, and cross-account or cross-boundary IAM. Practical experience migrating Node.js runtimes, including dependency upgrades, deprecation handling, and compatibility testing. Experience designing and maintaining CI/CD pipelines using OIDC federation and approval gates, with GitHub Actions or equivalent tools. Working knowledge of observability and monitoring solutions, including AWS X-Ray, CloudWatch metrics and alarms, and log retention. Strong communication skills and the ability to work effectively with both technical and non-technical stakeholders. Comfortable working in environments where requirements may evolve and parts of the technical scope are still being defined. Fluent English at approximately C1 level for daily communication with clients and stakeholders. Benefits: 100% remote work from Brazil. Hourly contractor engagement. Estimated contract duration of 6–8 weeks. Opportunity to work on a live AWS serverless production environment with active external consumers. Hands-on experience with AWS CDK, CloudFormation, Terraform, serverless architecture, security, and infrastructure modernization. Work aligned with EST or MST time zones. Opportunity to contribute to a technically focused modernization project involving production infrastructure, CI/CD, security, and observability. How Jobgether works: We use an AI-powered matching process to ensure your application is reviewed quickly, objectively, and fairly against the role's core requirements. Our system identifies the top-fitting candidates, and this shortlist is then shared directly with the hiring company. The final decision and next steps (interviews, assessments) are managed by their internal team. We appreciate your interest and wish you the best! Why Apply Through Jobgether? Data Privacy Notice: By submitting your application, you acknowledge that Jobgether will process your personal data to evaluate your candidacy and share relevant information with the hiring employer. This processing is based on legitimate interest and pre-contractual measures under applicable data protection laws (including GDPR). You may exercise your rights (access, rectification, erasure, objection) at any time. #LI-CL1