Introduction
The Maryland State Department of Education is dedicated to supporting a world-class educational system that prepares all students for college and career success in the 21st century. With excellent stewardship from our divisions, we oversee State and federal programs that support the needs of a diverse population – students, teachers, principals, and other educators throughout Maryland.
This is a Contractual position, and serves at the pleasure of the Appointing Authority.
GRADE
22
LOCATION OF POSITION
Nancy S. Grasmick Education Building
200 W. Baltimore Street Baltimore, MD 21201
Hybrid schedule available (up to 3 telework days permitted each week)
Main Purpose of Job
The Senior AWS Platform Engineer serves as ITB's hands-on platform engineering resource for
MSDE's AWS environment, executing platform engineering, migration, and cost-management
work on production-critical systems that support MSDE programs, Local Education Agencies
(LEAs), and the families and providers those programs serve. Reporting to the Director of IT
Infrastructure, this position operates within the technical standards and security baselines
established by the Department of Information Technology (DoIT), while working directly with
MSDE program divisions to plan and execute infrastructure changes that fit each program's
operational needs.
This position provides core AWS platform engineering across the services and toolsets MSDE
relies on, including identity and access management (RBAC), network and firewall
administration, and security-aware development practices. The engineer plans and executes lift-
and-shift and environment-to-environment migrations, applying change management discipline
to protect interfaces and prevent interruption to production-critical systems. Work is performed
within DoIT's established AWS standards, security baselines, and toolchains, and within the
operational realities and constraints of each MSDE program division being served.
The Senior AWS Platform Engineer is responsible for light architecture guidance, FinOps/cost
engineering, and cost forecasting for MSDE's AWS footprint, identifying cost drivers and
optimization opportunities and translating them into clear reporting for ITB leadership. The
position maintains working familiarity with DevOps toolchains and containerized
environments, including AWS Fargate and common CI/CD pipelines, in support of ITB's
broader technical operations.
This position works directly with an ITB Project Manager and with client contacts in program
divisions to plan and sequence infrastructure work, and coordinates directly with DoIT's AWS
team to execute MSDE's prioritized list of AWS tasks. The engineer is expected to operate with
limited supervision, exercising sound independent judgment on day-to-day platform work
while proactively raising questions, risks, and dependencies rather than waiting to be asked,
and escalating appropriately when a matter falls to DoIT or exceeds established standards.
The position provides extensive troubleshooting support across the AWS platform and is
expected to understand the operational stakes of production-critical systems, including the
systems and interfaces that connect them, well enough to protect uptime during any change.
Familiarity with cloud security posture management tools such as Wiz and SIEM platforms
such as Microsoft Sentinel is a plus, supporting this position's security-aware approach to
platform engineering and development.
Duties Include:
AWS Platform Engineering, RBAC & Security-Aware Development
• Perform hands-on AWS platform engineering across core services and toolsets, including IAM, VPCs, subnets/security groups/NACLs, EC2, RDS, KMS, CloudWatch/CloudTrail, and multi-account management (AWS Organizations)
• Configure and maintain role-based access controls (RBAC) governing platform and application access
• Apply security-aware development practices, developing and configuring within frameworks and standards defined by DoIT
• Coordinate directly with DoITs AWS team to execute MSDE's prioritized list of AWS platform tasks
Migrations & Production Change Management
• Plan and execute lift-and-shift and environment-to-environment migrations for MSDE workloads in AWS
• Apply change management discipline to moves and migrations affecting production-critical systems, including sequencing and rollback planning
• Identify and protect system interfaces and integrations during migrations and other platform changes to prevent interruption
• Work directly with an ITB Project Manager to sequence and schedule infrastructure initiatives
FinOps & Cost Engineering
• Analyze AWS spend to identify cost drivers and optimization opportunities across MSDE's AWS accounts
• Produce cost forecasts and regular reporting to ITB leadership on AWS spend and variance
• Provide light architecture input on resource sizing and configuration to support cost efficiency
• Maintain awareness of cloud security posture and monitoring tooling (e.g., Wiz, Microsoft Sentinel) relevant to cost and risk visibility
• Recommend cost optimization actions (rightsizing, scheduling, reserved capacity) within DoIT-approved practices
Troubleshooting & Network Security
• Perform extensive troubleshooting across the AWS platform, diagnosing and resolving issues affecting production-critical systems
• Configure and administer firewall rules and network security settings within DoIT standards
• Conduct root-cause analysis on recurring or complex issues and implement durable fixes rather than workarounds
MINIMUM QUALIFICATIONS
Education: Bachelor’s degree in Computer Science, Information Technology, Systems Engineering, or a related field is required.
Experience: Three or more years of direct experience provisioning, securing, and maintaining AWS cloud infrastructure, preferably in a public sector environment. This experience must include administering Windows Server EC2 instances and AWS WorkSpaces, along with foundational tasks like AMI creation, container management with EKS and Fargate, and database backup configuration for systems like IBM DB2. Additionally, candidates need proven experience executing production lift and shift migrations under formal change control, managing cloud cost optimization, and enforcing strict role based access control and network security standards.
Notes:
1. Candidates may substitute professional hands on experience in AWS cloud engineering and systems administration on a year for year basis in place of a four year degree.
SPECIAL REQUIREMENTS
Applicants must consent to a State Police Investigation (fingerprinting) as a routine procedure for all employees with this Agency.
SELECTION PROCESS
Please make sure that you provide sufficient information on your application to show that you meet the qualifications for this recruitment. All information concerning your qualifications must be submitted by the closing date. We will not consider information submitted after this date. Successful candidates will be ranked as Best Qualified, Better Qualified, or Qualified and placed on the eligible (employment) list for at least one year.
For education obtained outside the U.S., a copy of the equivalent American education as determined by a foreign credential evaluation service must be provided prior to hire.
BENEFITS
Contractual employees who work for an agency covered under the State Employee and Retiree Health and Welfare Benefits Program, have a current employment contract and work 30 or more hours a week (or on average 130 hours per month) may be eligible for subsidized health benefits coverage for themselves and their dependents. As a contractual employee, you will be responsible for paying 25% of the premiums for your medical and prescription coverage, including any eligible dependents you have enrolled. The State of Maryland will subsidize the remaining 75% of the cost for these benefits. You can also elect to enroll in dental coverage, accidental death and dismemberment insurance, and life insurance, but will be responsible to pay the full premium for these benefits.
Leave may be granted to a contractual employee at a rate of one hour for every 30 hours worked, not to exceed 40 hours per calendar year.
FURTHER INSTRUCTIONS
It is preferred that applicants complete the MD State Government online application for employment. The application must clearly demonstrate that the applicant meets the minimum qualifications for the position. If you are unable to apply online, paper applications can be obtained from the link below and mailed to MSDE Human Resources Branch, 200 W. Baltimore Street, Baltimore, MD 21201. If there is a supplemental questionnaire, this must be completed and sent in with your paper application, if you are unable to apply online.
All application materials must be received in our office by the closing date. Postmarks will not be accepted. Applications must be complete to be considered including all related job duties, even if those are also listed on an attached resume. Additional required materials may be uploaded with the online application, submitted to the fax number, or mailed to the Human Resources address listed above.
Inquiries can be made to 410-767-0012, TDD 410-333-3045. Appropriate accommodations can be made for individuals with disabilities.
If you have difficulty with your user account or have general questions about this online application system, please contact the MD Department of Budget and Management, Recruitment and Examination Division at 410-767-4850. TTY Users: Call via Maryland Relay.
Proof of eligibility to work is required in compliance with the Immigration Reform and Control Act. Any misrepresentation of academic or experience requirements for this position may result in non-selection or termination of employment.
As an equal opportunity employer, Maryland is committed to recruiting, retaining and promoting employees who are reflective of the State’s diversity. People with disabilities and bilingual candidates are encouraged to apply.
We thank our Veterans for their service to our country.
