Infrastructure Engineer, Sr

Position:	Senior Infrastructure Engineer
Job Code:
Business Unit:	Corporate Shared Services / IT
FLSA Status:	Exempt
Reports to:	VP, Infrastructure
Supervisory Role:	No
Location:	Anaheim, CA
Salary Range:		Bonus:	Yes	Incentive:	No

About The Change Company

We take our mission to bank the underbanked seriously, fairly and responsibly. We bring digital-first banking, lending, and financial services to underserved communities, transforming the financial landscape.

We are a diverse, inclusive, and entrepreneurial organization that values collaboration, innovation, and customer focus. Our experienced leadership team drives growth and long-term success while serving tens of thousands of customers through responsible lending and banking solutions.

We have an experienced leadership team who have served in various fintech, banking and lending industries. We are a Community Development Financial Institution (CDFI) serving 50,000+ borrowers with over $10 Billion in loans since our CDFI certification.

Join us in building modern, data-driven platforms that power financial inclusion and innovation.

About the Role

The Senior Infrastructure Engineer reports directly to the VP, Infrastructure and owns the design, build, security, and day-to-day operation of the platform our lending business runs on: enterprise networking, our AWS and Azure environments, our co-located data center footprint, and the controls that protect borrower non-public personal information (NPI).

This is a hands-on senior individual contributor role on a small team. You will make the architectural call, write the Terraform, rack the hardware, tune the firewall rule, answer the auditor’s question, and take the after-hours page. We are looking for breadth backed by real depth in at least two of the areas below, an automation-first instinct, and the judgment to operate safely in a regulated, examined environment.

Essential Job Duties / Responsibilities

Network Infrastructure

• Own routing and switching across the colocation facility, corporate offices, and remote workforce — BGP, OSPF, VLAN and VRF design, QoS, and resilient topologies with no single points of failure.
• Configure and maintain next-generation firewalls (Palo Alto, Fortinet, or Cisco FTD), IPS and decryption policy, and drive segmentation between production, corporate, vendor, and NPI zones.
• Manage site-to-site and remote-access VPN and SD-WAN, and the migration toward SASE/ZTNA; manage carrier circuits, cross-connects, and bandwidth capacity planning.
• Operate load balancing and application delivery (F5, AWS ALB/NLB, Azure Front Door and Application Gateway), WAF, and DDoS protection.
• Own DNS, DHCP, IPAM, and certificate lifecycle; troubleshoot at the packet level and maintain NetFlow telemetry and configuration-compliance baselines.

Cloud Platforms — AWS and Azure

• Design and maintain AWS multi-account structure (Organizations, Control Tower, service control policies) and Azure management group, subscription, and Azure Policy governance.
• Build and operate hybrid cloud networking: VPC and Transit Gateway, Direct Connect, PrivateLink, and Route 53 in AWS; VNet hub-and-spoke, Azure Firewall, ExpressRoute, and Private Link in Azure.
• Own cloud identity and key management — AWS IAM and KMS, Microsoft Entra ID with Conditional Access and Privileged Identity Management, Key Vault, and Secrets Manager.
• Operate cloud workloads and data services (EC2, ECS/EKS, RDS, S3; Azure VMs, AKS, and storage), including encryption, backup, and documented cross-region recovery.
• Maintain cloud security posture with GuardDuty, Security Hub, AWS Config, Microsoft Defender for Cloud, and Sentinel; manage tagging standards, rightsizing, and commitment-based cost optimization.

Co-located Data Center

• Plan rack elevations, A/B power and PDU load, cooling headroom, structured cabling, and cross-connects; coordinate smart-hands and maintenance windows with the facility.
• Operate virtualization, compute, and storage (VMware vSphere or equivalent, SAN/NAS, hyperconverged platforms), including firmware and hardware lifecycle planning.
• Own backup and disaster recovery — immutable and off-site copies, documented RTO/RPO, and at least annual tested failover with written results.
• Maintain out-of-band access (console servers, iDRAC/iLO) and recovery runbooks another engineer can follow at 3 a.m.

Cyber Security

• Apply zero-trust and least-privilege principles across on-premises and cloud estates, and harden systems to CIS Benchmarks.