AWS Architect

Job Title: AWS Architect

Job Type: B2B or Fulltime

Location: Krakow ,Poland

Work Mode: Remote OR Hybrid

We at Coforge are looking for AWS Architect with the following skills:

Keys Skills

• Build and configure the AWS PoV environment, including VPC, subnets, route tables, security groups and controlled outbound paths.

• Implement AWS DMS for MongoDB CDC, including full load and ongoing change replication from the named secondary.

• Configure DMS endpoints, replication task, checkpointing, CDC latency monitoring and recovery procedures.

• Use AWS DMS to capture ActionEntry, Transaction, Movement and related in-scope collections.

• Route DMS output into Amazon Kinesis Data Streams as the single event log.

• Use Amazon Kinesis Firehose to write immutable raw change history into the S3 event store.

• Build an Amazon S3 event store with Object Lock governance mode, retention controls and replay-ready storage.

• Implement PostgreSQL RDS as the financial ledger target.

• Implement Amazon DynamoDB as the audit target, including single-table design, tenant-scoped keys, on-demand capacity and PITR.

• Use AWS Secrets Manager to store and control access to the read-only MongoDB CDC credential.

• Use AWS KMS customer-managed keys for RDS, DynamoDB, S3, Kinesis, Secrets Manager, pseudonymisation and report signing.

• Configure AWS CloudTrail for account-wide audit logging, including DynamoDB data events.

• Configure CloudWatch logging and metrics for DMS, pgAudit logs, tunnel status, alarms and operational evidence.

• Use VPC Flow Logs to evidence that MongoDB traffic only traverses the approved path.

• Implement AWS Site-to-Site VPN as the preferred encrypted transport path between AWS and the Hetzner private network.

• Define fallback direct controlled access if the VPN path is not available by the required P0 timeline.

• Build CloudWatch alarms, EventBridge rules and Step Functions workflows to suspend CDC automatically when source-impact thresholds are breached.

• Implement a Lambda-based source-impact guard to monitor canary reads, member role, oplog headroom and DMS latency.

• Run reconciliation workloads as containerised Python jobs on ECS Fargate, orchestrated by Step Functions and scheduled by EventBridge Scheduler.

• Run replay tooling as ECS Fargate batch jobs using S3 event-store data and RDS isolated replay schemas.

• Run JMeter load-testing harness on ECS Fargate against the ReThink-IT-provided MongoDB 5.0 replica set.

• Capture DMS lag, JMeter throughput and synthetic-event latency metrics through CloudWatch.

• Implement cross-tenant isolation using tenant-specific IAM roles and DynamoDB LeadingKeys conditions.

• Correlate isolation test cases with CloudTrail, DynamoDB data events and PostgreSQL pgAudit logs.

• Use Terraform 1.5+ for all AWS infrastructure provisioning.

• Use GitHub Actions with OIDC to deploy AWS infrastructure with protected environments, PR plans and apply-on-merge controls.

• Store Terraform state remotely with locking.

• Produce CloudTrail-derived reports proving zero manual AWS console-originated mutations.

• Build Athena-based reporting over CloudTrail logs for deployment evidence.

• Create Glue catalogue and Athena-queryable AI-ready export over partitioned Parquet data in S3.

• Implement S3 quarantine prefixes and alarms for non-conforming events.

• Build OpenSearch projection as an optional P3 component, with fallback to MongoDB and destruction after testing.

• Maintain AWS evidence artefacts including transport-security packs, reconciliation reports, event-loss reports, replay logs, lag reports, CloudTrail reports and teardown evidence.

• Perform AWS teardown and provide empty inventory, zero-billing and destruction confirmation evidence.

• Manage the AWS infrastructure cost envelope, including the Site-to-Site VPN cost within the stated EUR 150/month estimate.