Senior Platform Engineer

About ZERO

At ZERO, our mission is to simplify healthcare and eliminate financial barriers, ensuring that everyone has access to high-quality care at no cost. We work with self-funded employers and innovative healthcare providers to match members with the best healthcare options, enabling access to care for $0. Our vision is to create a world where healthcare works for everyone, empowering our clients and their employees to access care while reducing healthcare costs.

With offices in downtown Tulsa, OK, downtown Denver, CO, and a growing virtual team around the country, we are solving our country's healthcare cost problems by making healthcare for scheduled care simple, transparent, 100% accessible and affordable.

We are looking for a Sr Platform Engineer to take senior technical ownership of the AWS estate that everything at ZERO runs on.

This is a build role with real scope. You will write the standards the platform is built to, shape its architecture, and turn infrastructure into consumable services that the rest of the company can use without filing a ticket. Our architecture is sound and our practices are established; what we do not yet have is a dedicated senior engineer for it.

That is the job.

To be straight with you about how decisions get made: you author the standards and give the architectural direction, and the Director approves the standards and holds the final call on architecture this year. You will have close access to that decision and your recommendations will carry weight. If you are looking for unchecked architectural authority on day one, this is not that role yet.

You will also own how internal software becomes real. Our operators build prototypes, our engineering and data teams build services, and this role decides what is ready to run in production and rebuilds what is not. If you have wanted to define a production readiness bar and actually hold it, this role has that authority.

We are a small team, which means you will have unusual latitude and you will not be far from any decision. It also means we care a great deal about documentation, because the standards you write are the standards we work to.

• Design, build, and operate our AWS multi-account architecture: account structure, networking, compute on EC2 and ECS/Fargate, and storage.
• Author and maintain Terraform modules and write the infrastructure-as-code standards that keep the estate reproducible, reviewable, and version controlled.
• Build and operate consumable platform services for internal consumers, treating the platform as a product with users rather than a queue with tickets.
• Own AWS IAM and AWS IAM Identity Center: roles, policies, permission boundaries, federation, permission sets, and cross-account access patterns.
• Manage container base images across engineering and infrastructure workloads, including multi-architecture builds.
• Implement security controls across the estate: least privilege, encryption and key management, network segmentation, and complete logging coverage. Build paved paths so the secure option is also the easiest one.
• Own backup architecture, disaster recovery runbooks, RTO and RPO targets, and failover testing on a documented cadence.
• Own capacity planning, monitoring, and observability coverage across Cloud Watch, Sumo Logic, and Datadog.
• Run the production readiness review for services transitioning in from Engineering or Data & Analytics, including the authority to send one back.
• Rebuild validated internal prototypes into supportable, compliant products, and own their lifecycle afterward.
• Author technical standards, review infrastructure changes and Terraform contributions, and provide technical direction and mentorship to the Platform Engineer.
• Write and maintain runbooks, architecture documentation, and standards.

• Six or more years in cloud infrastructure engineering, the majority of it hands-on with AWS.
• Production experience authoring Terraform modules and setting IaC standards, not only consuming them.
• Container workload experience with ECS, Fargate, or equivalent, including image lifecycle and multi-architecture builds.
• Depth in AWS IAM: roles, policies, permission boundaries, and cross-account access patterns.
• Backup and disaster recovery design experience, including having personally run a failover or recovery test.
• Strong Linux fundamentals and scripting in Python, Go, or Bash.
• Experience integrating infrastructure work with CI/CD pipelines.
• Demonstrated technical leadership:…