Infrastructure Engineer, Sr

Position:	Senior Infrastructure Engineer
Job Code:
Business Unit:	Corporate Shared Services / IT
FLSA Status:	Exempt
Reports to:	VP, Infrastructure
Supervisory Role:	No
Location:	Anaheim, CA
Salary Range:		Bonus:	Yes	Incentive:	No

About The Change Company

We take our mission to bank the underbanked seriously, fairly and responsibly. We bring digital-first banking, lending, and financial services to underserved communities, transforming the financial landscape.

We are a diverse, inclusive, and entrepreneurial organization that values collaboration, innovation, and customer focus. Our experienced leadership team drives growth and long-term success while serving tens of thousands of customers through responsible lending and banking solutions.

We have an experienced leadership team who have served in various fintech, banking and lending industries. We are a Community Development Financial Institution (CDFI) serving 50,000+ borrowers with over $10 Billion in loans since our CDFI certification.

Join us in building modern, data-driven platforms that power financial inclusion and innovation.

About the Role

The Senior Infrastructure Engineer reports directly to the VP, Infrastructure and owns the design, build, security, and day-to-day operation of the platform our lending business runs on: enterprise networking, our AWS and Azure environments, our co-located data center footprint, and the controls that protect borrower non-public personal information (NPI).

This is a hands-on senior individual contributor role on a small team. You will make the architectural call, write the Terraform, rack the hardware, tune the firewall rule, answer the auditor’s question, and take the after-hours page. We are looking for breadth backed by real depth in at least two of the areas below, an automation-first instinct, and the judgment to operate safely in a regulated, examined environment.

Essential Job Duties / Responsibilities

Network Infrastructure

• Own routing and switching across the colocation facility, corporate offices, and remote workforce — BGP, OSPF, VLAN and VRF design, QoS, and resilient topologies with no single points of failure.
• Configure and maintain next-generation firewalls (Palo Alto, Fortinet, or Cisco FTD), IPS and decryption policy, and drive segmentation between production, corporate, vendor, and NPI zones.
• Manage site-to-site and remote-access VPN and SD-WAN, and the migration toward SASE/ZTNA; manage carrier circuits, cross-connects, and bandwidth capacity planning.
• Operate load balancing and application delivery (F5, AWS ALB/NLB, Azure Front Door and Application Gateway), WAF, and DDoS protection.
• Own DNS, DHCP, IPAM, and certificate lifecycle; troubleshoot at the packet level and maintain NetFlow telemetry and configuration-compliance baselines.

Cloud Platforms — AWS and Azure

• Design and maintain AWS multi-account structure (Organizations, Control Tower, service control policies) and Azure management group, subscription, and Azure Policy governance.
• Build and operate hybrid cloud networking: VPC and Transit Gateway, Direct Connect, PrivateLink, and Route 53 in AWS; VNet hub-and-spoke, Azure Firewall, ExpressRoute, and Private Link in Azure.
• Own cloud identity and key management — AWS IAM and KMS, Microsoft Entra ID with Conditional Access and Privileged Identity Management, Key Vault, and Secrets Manager.
• Operate cloud workloads and data services (EC2, ECS/EKS, RDS, S3; Azure VMs, AKS, and storage), including encryption, backup, and documented cross-region recovery.
• Maintain cloud security posture with GuardDuty, Security Hub, AWS Config, Microsoft Defender for Cloud, and Sentinel; manage tagging standards, rightsizing, and commitment-based cost optimization.

Co-located Data Center

• Plan rack elevations, A/B power and PDU load, cooling headroom, structured cabling, and cross-connects; coordinate smart-hands and maintenance windows with the facility.
• Operate virtualization, compute, and storage (VMware vSphere or equivalent, SAN/NAS, hyperconverged platforms), including firmware and hardware lifecycle planning.
• Own backup and disaster recovery — immutable and off-site copies, documented RTO/RPO, and at least annual tested failover with written results.
• Maintain out-of-band access (console servers, iDRAC/iLO) and recovery runbooks another engineer can follow at 3 a.m.

Cyber Security

• Apply zero-trust and least-privilege principles across on-premises and cloud estates, and harden systems to CIS Benchmarks.
• Run vulnerability management end to end — authenticated scanning, severity-based patch SLAs, remediation tracking, and documented risk acceptances with compensating controls.
• Partner on EDR and SIEM coverage, log source onboarding, and alert tuning; take an active role in incident response through containment, recovery, and post-incident review.
• Manage privileged access, service account hygiene, secrets rotation, and periodic access reviews.
• Maintain encryption in transit and at rest, TLS and certificate standards, and email authentication with SPF, DKIM, and DMARC.

Automation and Infrastructure as Code

• Build and maintain reusable Terraform (or OpenTofu) modules for AWS and Azure with sound state management and drift detection; manual console changes are the documented exception.
• Run infrastructure changes through Git-based review and CI/CD pipelines with policy-as-code checks.
• Automate server and appliance configuration with Ansible and PowerShell, and automate network configuration backup and compliance checking.
• Write production-quality Python and PowerShell — tested, version controlled, and readable by the next engineer.

Operations, Support, and Compliance

• Participate in a shared on-call rotation and act as incident commander for infrastructure events; plan and execute after-hours change windows with validation steps and a tested rollback plan.
• Own monitoring and alerting coverage and alert quality, and keep network diagrams, IP plans, and runbooks current.
• Implement and evidence infrastructure controls under the GLBA Safeguards Rule, SOC 2, and applicable investor and state requirements.
• Serve as a technical point of contact for internal audit, external auditors, investor and warehouse lender reviews, and regulatory examinations.
• Maintain and test the technology portions of the business continuity and disaster recovery plan.
• Complete special tasks as assigned by manager as needed.
• Regular on-site attendance.