Cloud Migration Engineer

About the Role We are migrating a portfolio of on-premise applications - many of which depend on Java Spring Boot services, on-prem Apache Kafka clusters for event streaming, and inter-service messaging - to Amazon Web Services. We need an experienced engineer who has done this end-to-end before: assessing applications, untangling on-prem dependencies, re-platforming to AWS-managed services where it makes sense (and lifting-and-shifting where it doesn't), cutting over with zero data loss, and leaving behind a clean, observable, cost-efficient footprint. You will own technical migration of multiple Spring Boot services from discovery through stabilization, partnering with the application teams who built them and the platform team that runs AWS. What You'll Do Assessment & Planning Inventory in-scope Java / Spring Boot applications and their Kafka topics, consumer groups, and partitioning patterns. Map on-prem dependencies (databases, file shares, schedulers, secrets stores, AD/Kerberos) to AWS equivalents or hybrid solutions. Define cutover strategy per service. Application Re-platforming Upgrade Spring Boot applications to versions compatible with AWS SDKs and current Java, modernizing deprecated APIs. Replace on-prem auth (LDAP, Kerberos, mTLS with internal CAs) with AWS IAM, IAM Roles for Service Accounts (IRSA), auth for RDS/DocumentDB/MSK, and AWS Certificate Manager. Containerize services (Docker, multi-stage builds, distroless / Amazon Corretto base images) and deploy via Amazon EKS, ECS Fargate, App Runner, or AWS Lambda - selecting the right runtime per workload. Implement health checks, graceful shutdown, JVM tuning for containerized environments (-XX:MaxRAMPercentage, G1/ZGC selection, JFR), and right-size compute. Kafka Migration Migrate on-prem Kafka workloads to Amazon MSK (provisioned or Serverless). Design topic replication and cutover using MirrorMaker 2, MSK Replicator, or Confluent Replicator; handle offset translation and consumer-group cutover. Re-architect security: from SASL/PLAIN + on-prem ACLs to SASL/SCRAM in Secrets Manager, mTLS via ACM Private CA, or IAM authentication for MSK; topic ACLs / Kafka quotas as code. Tune producer/consumer clients (acks, linger.ms, batch.size, max.poll.records, enable.idempotence, transactional producers) for AWS network characteristics. Data & State Migration Migrate relational data using AWS DMS (full load + CDC) to RDS/Aurora; document datastores to DocumentDB or MongoDB Atlas on AWS; caches to ElastiCache (Redis / Valkey / Memcached). Validate row counts, checksums, and business-key parity post-migration. Coordinate dual-write windows / outbox-pattern when Kafka and the source DB are migrated in different waves. Infrastructure as Code & CI/CD Provision all AWS resources via AWS CDK (Java / TypeScript), following team standards. Build CI/CD pipelines (GitLab CI, GitHub Actions). Observability & SRE Wire Micrometer; structured JSON logging to CloudWatch Logs or OpenSearch; distributed tracing via AWS X-Ray or OpenTelemetry. Build Grafana / CloudWatch dashboards and alarms for JVM, Kafka lag, error budgets, and cost. Author runbooks, SLOs, on-call playbooks, and post-migration retrospectives. Security, Compliance & Cost Apply least-privilege IAM, VPC Endpoints (PrivateLink), security groups, WAF, GuardDuty, and findings remediation. Encrypt data at rest (KMS with CMK rotation) and in transit (TLS 1.2+); manage secrets in Secrets Manager with automatic rotation. Optimize cost: right-sizing, Savings Plans / Reserved Instances, Graviton migration (r8g / m7g / c7g), S3 storage classes, log retention policies, and idle-resource teardown. Required Qualifications 8+ years of experience building production back-end systems in Java; 5+ years with Spring Boot (2.x and 3.x), Spring Data, Spring Security. 5+ years of hands-on experience with Apache Kafka as both producer and consumer, including topic design, partitioning, consumer groups, exactly-once semantics, schema evolution, and ops (rebalances, ISR, broker tuning). 3+ years of substantive AWS delivery experience - not just experiments; production workloads you can describe. At least one prior on-prem → AWS migration of multiple services that you owned end-to-end, including the Kafka layer. AWS Depth Deep working knowledge of: EKS or ECS/Fargate, MSK (or Confluent Cloud on AWS), VPC networking, IAM, RDS/Aurora, S3, Secrets Manager/Parameter Store, CloudWatch, KMS, Route 53, ALB/NLB, CloudFront, API Gateway. Infrastructure as code with Terraform or AWS CDK. Comfortable reading and writing AWS CLI / boto3 / Java SDK v2. Java / Spring / Kafka Depth Modern Java (17 / 21) - records, pattern matching, virtual threads, JFR-based diagnosis. Spring Boot 3 / Spring Framework 6 migration (Jakarta EE namespace, AOT / native via GraalVM where relevant). Spring for Apache Kafka and/or Spring Cloud Stream in production: @KafkaListener, ConcurrentKafkaListenerContainerFactory, custom error handlers, RetryTopicConfiguration, transactional producers. Confluent Schema Registry / Avro / Protobuf in CI pipelines (schema-compatibility checks, registry promotion). Performance / latency diagnosis: thread dumps, heap analysis, async-profiler, JFR. Soft Skills Strong written communication - ADRs, runbooks, migration playbooks. Comfortable embedding briefly into multiple application teams. Pragmatic: knows when to refactor and when to rehost. Nice to Have Kubernetes certifications (CKA / CKAD / CKS); AWS Certified Solutions Architect - Professional, DevOps Engineer - Professional, or Advanced Networking - Specialty. Experience with hybrid networking (AWS Direct Connect, Transit Gateway, VPN, PrivateLink) and routing between on-prem data centers and AWS during migration.