Infrastructure Engineer, Sr

Job Details: Job Location: Anaheim-CL Branch - Anaheim, CA, Position Type: Full Time, Salary Range: $130000.00 - $180000.00Salary/year, Position: Senior Infrastructure Engineer Job Code:   Business Unit: Corporate Shared Services / IT FLSA Status: Exempt Reports to: VP, Infrastructure Supervisory Role: No Location: Anaheim, CA Salary Range:   Bonus: Yes Incentive: No   About The Change Company We take our mission to bank the underbanked seriously, fairly and responsibly. We bring digital-first banking, lending, and financial services to underserved communities, transforming the financial landscape. We are a diverse, inclusive, and entrepreneurial organization that values collaboration, innovation, and customer focus. Our experienced leadership team drives growth and long-term success while serving tens of thousands of customers through responsible lending and banking solutions. We have an experienced leadership team who have served in various fintech, banking and lending industries. We are a Community Development Financial Institution (CDFI) serving 50,000+ borrowers with over $10 Billion in loans since our CDFI certification.  Join us in building modern, data-driven platforms that power financial inclusion and innovation. About the Role The Senior Infrastructure Engineer reports directly to the VP, Infrastructure and owns the design, build, security, and day-to-day operation of the platform our lending business runs on: enterprise networking, our AWS and Azure environments, our co-located data center footprint, and the controls that protect borrower non-public personal information (NPI). This is a hands-on senior individual contributor role on a small team. You will make the architectural call, write the Terraform, rack the hardware, tune the firewall rule, answer the auditor’s question, and take the after-hours page. We are looking for breadth backed by real depth in at least two of the areas below, an automation-first instinct, and the judgment to operate safely in a regulated, examined environment. Essential Job Duties / Responsibilities Network Infrastructure Own routing and switching across the colocation facility, corporate offices, and remote workforce — BGP, OSPF, VLAN and VRF design, QoS, and resilient topologies with no single points of failure. Configure and maintain next-generation firewalls (Palo Alto, Fortinet, or Cisco FTD), IPS and decryption policy, and drive segmentation between production, corporate, vendor, and NPI zones. Manage site-to-site and remote-access VPN and SD-WAN, and the migration toward SASE/ZTNA; manage carrier circuits, cross-connects, and bandwidth capacity planning. Operate load balancing and application delivery (F5, AWS ALB/NLB, Azure Front Door and Application Gateway), WAF, and DDoS protection. Own DNS, DHCP, IPAM, and certificate lifecycle; troubleshoot at the packet level and maintain NetFlow telemetry and configuration-compliance baselines. Cloud Platforms — AWS and Azure Design and maintain AWS multi-account structure (Organizations, Control Tower, service control policies) and Azure management group, subscription, and Azure Policy governance. Build and operate hybrid cloud networking: VPC and Transit Gateway, Direct Connect, PrivateLink, and Route 53 in AWS; VNet hub-and-spoke, Azure Firewall, ExpressRoute, and Private Link in Azure. Own cloud identity and key management — AWS IAM and KMS, Microsoft Entra ID with Conditional Access and Privileged Identity Management, Key Vault, and Secrets Manager. Operate cloud workloads and data services (EC2, ECS/EKS, RDS, S3; Azure VMs, AKS, and storage), including encryption, backup, and documented cross-region recovery. Maintain cloud security posture with GuardDuty, Security Hub, AWS Config, Microsoft Defender for Cloud, and Sentinel; manage tagging standards, rightsizing, and commitment-based cost optimization. Co-located Data Center Plan rack elevations, A/B power and PDU load, cooling headroom, structured cabling, and cross-connects; coordinate smart-hands and maintenance windows with the facility. Operate virtualization, compute, and storage (VMware vSphere or equivalent, SAN/NAS, hyperconverged platforms), including firmware and hardware lifecycle planning. Own backup and disaster recovery — immutable and off-site copies, documented RTO/RPO, and at least annual tested failover with written results. Maintain out-of-band access (console servers, iDRAC/iLO) and recovery runbooks another engineer can follow at 3 a.m. Cyber Security Apply zero-trust and least-privilege principles across on-premises and cloud estates, and harden systems to CIS Benchmarks. Run vulnerability management end to end — authenticated scanning, severity-based patch SLAs, remediation tracking, and documented risk acceptances with compensating controls. Partner on EDR and SIEM coverage, log source onboarding, and alert tuning; take an active role in incident response through containment, recovery, and post-incident review. Manage privileged access, service account hygiene, secrets rotation, and periodic access reviews. Maintain encryption in transit and at rest, TLS and certificate standards, and email authentication with SPF, DKIM, and DMARC. Automation and Infrastructure as Code Build and maintain reusable Terraform (or OpenTofu) modules for AWS and Azure with sound state management and drift detection; manual console changes are the documented exception. Run infrastructure changes through Git-based review and CI/CD pipelines with policy-as-code checks. Automate server and appliance configuration with Ansible and PowerShell, and automate network configuration backup and compliance checking. Write production-quality Python and PowerShell — tested, version controlled, and readable by the next engineer. Operations, Support, and Compliance Participate in a shared on-call rotation and act as incident commander for infrastructure events; plan and execute after-hours change windows with validation steps and a tested rollback plan. Own monitoring and alerting coverage and alert quality, and keep network diagrams, IP plans, and runbooks current. Implement and evidence infrastructure controls under the GLBA Safeguards Rule, SOC 2, and applicable investor and state requirements. Serve as a technical point of contact for internal audit, external auditors, investor and warehouse lender reviews, and regulatory examinations. Maintain and test the technology portions of the business continuity and disaster recovery plan. Complete special tasks as assigned by manager as needed. Regular on-site attendance. Qualifications: What Skills & Requirements You'll Need Required 7+ years of progressive enterprise infrastructure experience, including 3+ years at a senior or lead level with end-to-end ownership of production systems. Deep, hands-on enterprise networking experience: routing, switching, next-generation firewalls, and VPN in a multi-site production environment. Demonstrated production experience in both AWS and Azure — environments you built, secured, and operated, not lab or certification-only exposure. Direct experience operating physical infrastructure in a colocation or on-premises data center, including virtualization, storage, and backup. Practical security engineering background: segmentation, vulnerability and patch management, identity and access controls, and participation in real incidents. Infrastructure as code in production (Terraform or equivalent), scripting in Python and/or PowerShell, and fluency with Git-based change workflow. At least one current professional- or expert-level certification in networking, cloud, or security — for example CCNP Enterprise or CCNP Security, AWS Certified Solutions Architect – Professional, Azure Solutions Architect Expert (AZ-305), or CISSP — or equivalent demonstrated experience. Availability for on-call rotation, after-hours change windows, and incident escalation. Strong written documentation skills and the ability to explain technical risk and tradeoffs to non-technical business leaders. Comfort working on a small team with broad ownership, shifting priorities, and limited specialist backup. Understanding of the mortgage industry and the handling requirements for borrower NPI. Bachelor’s degree or equivalent work experience. Preferred Experience in mortgage, banking, or another regulated financial services environment. Experience serving as the infrastructure point-person during SOC 2, GLBA, investor, or warehouse lender examinations. Additional certifications such as AWS Advanced Networking or Security Specialty, AZ-500, AZ-700, Palo Alto PCNSE, HashiCorp Terraform Associate, or VMware VCP-DCV. Kubernetes in production (EKS or AKS), including cluster networking and workload identity. SASE/ZTNA migration experience replacing traditional VPN concentrators. FinOps practice: cloud cost allocation, showback, and optimization at scale. Experience leading a data center migration, colocation relocation, or cloud migration end to end. Mentoring junior engineers and setting technical standards for a team. Physical Demands and Work Environment The physical demands described here are representative of those that must be met by an employee to successfully perform the essential job functions of this position. Reasonable accommodations may be made to enable individuals with disabilities to perform the functions. While performing the duties of this job, the employee is regularly required to: communicate and accurately exchange information with clients at normal speaking levels; remain standing for sustained periods of time; use hands to finger, grasp, or feel; reach by extending hand(s) and arm(s) in any direction; have visual acuity to view a laptop, determine the accuracy, neatness, and thoroughness of the work assigned. Working conditions are generally moderate and in an office environment. This position also requires periodic work in a colocation data center environment, including racking and cabling equipment, working in cold aisles, and lifting equipment weighing up to 50 pounds, as well as participation in an on-call rotation with scheduled after-hours maintenance windows. Note This job description is meant to describe the general nature and level of work being performed; it is not intended to be an exhaustive list of all responsibilities, duties, and skills required for the position. While this is intended to be an accurate reflection of the current job, the Company reserves the right to revise the job or to require that other or different tasks, duties, and responsibilities be performed as assigned, or to otherwise change this job description at any time with or without notice. The company is an Equal Opportunity Employer, drug free workplace, and complies with ADA and State regulations as applicable.