Senior Platform Engineer

Job Title: Senior Platform Engineer

Department: Infrastructure and Security

Type: Full-time

Reports to: Head of Infrastructure and Security

This role requires a minimum of four (4) days per week working onsite at EnStream’s head office in Toronto; this requirement may be changed at management’s discretion.

Who is EnStream

EnStream is a leader in secure digital identity and mobile data intelligence, working to advance the future of digital trust in Canada. We build innovative data-driven models that enhance the integrity, reliability, and safety of digital identity ecosystems.

Our mission is to empower frictionless trust in every interaction. EnStream is dedicated to increasing trust and convenience for Canadians using real-life, verified identities and network data held by trusted telco networks. At EnStream, every team member plays a critical role in shaping our strategy and delivering meaningful impact across industries.

About the Role

EnStream is seeking a Senior Platform Engineer to join our team as a full-time, hands-on cloud infrastructure owner. This role serves as one of two in-house engineers anchoring EnStream's hybrid operating model - responsible for the reliability, security, and evolution of our AWS environment while serving as the primary L2/L3 escalation point from NOC.

You will own the infrastructure that powers EnStream's identity platform: EC2, RDS, ECS, ELB, and a complex set of network integrations spanning cloud and on-premises environments. From IaC and CI/CD to network-layer troubleshooting and cloud security posture, this role touches every layer of the stack.

This is a hands-on, senior individual-contributor role with direct impact on platform reliability, security, and scale.

What You’ll Do

Platform Ownership & Architecture

• Own the design, build, and evolution of EnStream’s production AWS environment across EC2, RDS, ECS, ELB, and associated networking.
• Lead cloud architecture reviews and drive decisions on scalability, resilience, and cost optimization.
• Define and enforce IaC standards using Terraform or AWS CDK; establish GitOps workflows and infrastructure best practices.
• Own the technical infrastructure roadmap in partnership with the Head of Infrastructure and Security.

Data & AI Infrastructure

• Design and build the cloud infrastructure underpinning EnStream’s data and AI platform - compute provisioning, data pipelines, storage architecture, and supporting tooling.
• Collaborate with data and product teams to ensure the platform meets the performance, scale, and reliability requirements of AI/ML workloads.
• Evaluate and introduce appropriate tooling for data infrastructure (e.g., pipeline orchestration, model serving, vector storage) as the roadmap evolves.

Support & Incident Response

• Own L2/L3 support for cloud infrastructure; serve as the primary escalation point from the L1 NOC, and coordinate with the Application Engineering team on L3 escalations.
• Lead incident response for production issues; author post-mortems and drive systemic improvements.
• Define and maintain monitoring, alerting, and runbooks using CloudWatch, Grafana, or equivalent tooling.
• Participate in on-call rotation.

Security & Compliance

• Lead cloud security posture: WAF, GuardDuty, Security Hub, IAM least-privilege enforcement, KMS, Secrets Manager, and patch management.
• Troubleshoot network issues at the packet level across hybrid cloud and on-premises environments (tcpdump/Wireshark, routing diagnostics, firewall policy).
• Administer virtual firewalls (Palo Alto or equivalent); configure policies, NAT, and complex network integrations.

CI/CD & Developer Platform

• Design and operate CI/CD pipelines using CodePipeline, GitHub Actions, or equivalent.
• Administer and tune Nginx: reverse proxy configuration, upstream health checks, SSL/TLS termination, and performance tuning.
• Maintain documentation, runbooks, and a shared knowledge base that keeps the team self-sufficient.

What You Bring

Must-Have

• 5+ years of hands-on AWS infrastructure experience in production environments.
• AWS Certification required: Solutions Architect Professional or DevOps Engineer Professional.
• Hands-on experience with virtual firewalls (Palo Alto or equivalent): policy configuration, NAT, and hybrid network integrations.
• Proven ability to troubleshoot at the network layer: tcpdump/Wireshark, routing diagnostics, and connectivity analysis across hybrid environments.
• Production Nginx experience: reverse proxy, upstream health checks, SSL/TLS, and performance tuning.
• Strong IaC proficiency: Terraform (preferred) or AWS CDK/CloudFormation.
• Container orchestration experience: ECS or EKS in production.
• Solid Linux systems administration and scripting (Bash, Python).
• Familiarity with AWS security services: GuardDuty, Security Hub, IAM, KMS, Secrets Manager.
• Experience owning L2/L3 support in a hybrid model, comfortable triaging escalations from a managed L1 provider and coordinating with engineering teams on complex root cause analysis.
• Strong written communication; able to produce post-mortems, architecture documentation, and runbooks.

Nice-to-Have

• Hands-on experience building or supporting data and AI infrastructure (pipelines, ML compute, vector DBs, or similar).
• Additional AWS certifications (e.g., Advanced Networking Specialty, Machine Learning Specialty).
• Network security certification (e.g., PCNSE or NSE).
• Background in regulated industries: fintech, telecom, or financial services.
• Experience with MSSP or managed NOC/SOC integrations.
• Exposure to advanced APM or observability tooling.

Why Join Us?

• Contribute to a national-scale initiative defining the future of digital trust in Canada.
• Direct ownership of critical infrastructure serving Canada's major banks and carriers.
• A full-time, long-term role with real technical ownership at a growing, cloud-native company.
• Lean team where your decisions carry weight from day one; no bureaucracy, no ticket queues.
• Hybrid work model, flexibility with meaningful in-office collaboration.
• Professional development budget and certification support.