Need Networking Subject Matters Expert - Remote - W2

Networking SME -

Remote -

Long Term Contract - W2

Background: Customer is industrializing migration pathways from on-prem to AWS Kafka MSK, object storage S3, and eventually database replication. A team is building the migration tooling; we are responsible for the networking foundation that makes it all work. This is not Kafka expertise or storage expertise it's building repeatable, automatable network connectivity patterns that migration workloads consume - ALTHOUGH Kafka/File Storage/Database experience/knowledge would be very useful. The intent is to build these as reusable Lego blocks (CDK) so they can eventually be used by an AI-harnessed (or at least self service) so one-off manual setup won't work here. Customer network architecture basics:

• Cloud WAN ("CloudWAN segments") for global connectivity FastTrack (prod), SkyPath (proxy), SkyTransit (hybrid), Workload segments
• Shared VPCs (legacy "FastTrack" model) with Customer-routable + cloud-routable CIDR its being superseded by...
• Customer-Managed VPCs (new world) individual per-workload VPCs connected via VPC Lattice service networks. All new migration work goes here.
• "On-Ramp" = DX connection points (Client Ashburn, CoreSite Reston, Client Slough/Manchester). Connected to CloudWAN.
• SkyPath = TLS proxy fleet for cross-zone/cross-segment traffic. InfoSec-mandated but Mike Ahern (key stakeholder) is actively trying to bypass it for migration flows.
• On-prem network is flat; firewall between on-prem and cloud is IP-based with specific port openings.

A specific design already in play for Kafka: They're using VPC Lattice Resource Configs + Resource Gateway over DX to reach on-prem Kafka brokers from MSK Replicator. Each BU gets its own MSK VPC with Resource Endpoints mapping to on-prem broker DNS. A shared "Kafka Transit VPC" hosts the Resource Gateway + Route 53 Outbound Resolver for native broker DNS resolution. Firewall rules only permit the Resource Gateway IP as the inbound source to GSInet for specific broker:port combinations. All flows TLS encrypted E2E. For S3, similar pattern PrivateLink endpoints in a transit hub VPC with VGW directly on DX (no CloudWAN hop for cost optimization). Endpoint policies locked per LoB. What we need SMEs in: VPC Lattice (Resource Configs, Resource Gateway, service networks, service network VPC endpoints for hybrid access), AWS CloudWAN (segments, route filtering, advanced routing, TGW peering), Direct Connect (VIF automation, VGW direct attachment, DX Gateway patterns, 100G dedicated circuits), PrivateLink (interface endpoints at scale, endpoint policies with org-level condition keys like aws:PrincipalOrgID/aws:ResourceOrgPaths, transit hub VPC patterns), Route 53 Resolver (inbound/outbound endpoints, conditional forwarding for on-prem DNS zones), IAM data perimeter design (replacing traditional firewall allow/deny with native AWS constructs), and CDK/Python/CFT (infrastructure-as-code for repeatable network provisioning patterns, Lambda-based lifecycle automation).