Secure AWS, Ubuntu EC2, Docker Infrastructure 3x Application Servers

I am running a production web application on AWS using Ubuntu EC2 and Docker. The application is already secured at the backend level with authentication, rate limiting, JWT session management, GDPR endpoints, and security headers.
Now I need an experienced engineer to harden the infrastructure and deployment environment to production-grade security standards.
This is not a basic setup task. I am looking for someone who understands real-world security risks and can implement best practices across AWS, Linux, and Docker.
Current Setup
Ubuntu EC2 instance
Docker-based application (Node/FastAPI stack)
HTTP and HTTPS exposed
Basic security already implemented at application layer
Scope of Work
AWS Layer
Set up Application Load Balancer with HTTPS (ACM)
Restrict EC2 access to ALB only using security groups
Implement AWS WAF with basic protection and rate limiting
Enforce IMDSv2
Review and tighten IAM roles and permissions
EC2 / OS Layer
Harden Ubuntu server
Disable or restrict SSH access and configure AWS SSM access
Configure firewall (UFW)
Enable automatic security updates
Docker Layer
Review docker-compose and Dockerfiles
Remove any privileged configurations
Ensure containers run as non-root
Restrict container capabilities
Ensure only reverse proxy exposes ports
Isolate internal services (DB, Redis, etc.)
Secrets & Config
Move sensitive data out of .env files where possible
Integrate AWS Secrets Manager or SSM Parameter Store
Ensure secure handling of JWT secrets and credentials
Logging & Monitoring
Set up CloudWatch logging for application and system
Basic alerting for suspicious activity (failed logins, spikes, etc.)
Validation
Provide a checklist of changes implemented
Identify remaining risks or recommendations
Optional light penetration testing
Deliverables
Hardened AWS architecture
Updated Docker configuration
Security checklist and documentation
Clear explanation of changes made
Requirements
Strong experience with AWS (EC2, ALB, WAF, IAM)
Strong experience with Docker security and container hardening
Experience securing production web applications
Ability to explain decisions clearly