Devops Architect

We are seeking an experienced Platform Deployment Engineer to implement and operationalize a segmented, single-host RHEL/KVM network architecture supporting a Kubernetes platform for a digital transformation programme. The engineer will be responsible for building the virtualization layer, deploying and configuring API gateway and reverse proxy services, provisioning segmented Kubernetes worker nodes, and implementing the network, firewall-adjacent, and security controls defined in the approved High-Level Design (HLD) and Low-Level Design (LLD).

This role requires hands-on expertise across Red Hat Enterprise Linux virtualization (KVM), container orchestration (Kubernetes), API gateway/proxy technologies (APISIX, NGINX), and enterprise network segmentation concepts (VLANs, DMZ design, firewall/NAT coordination with a managed perimeter provider).

Platform & Virtualization Build

• Install, configure, and harden Red Hat Enterprise Linux (RHEL) as the KVM hypervisor host for all solution virtual machines.
• Build and manage Open vSwitch / Linux bridge networking to map VM interfaces to approved VLANs (operations/DB/KVM host, private-worker, public-worker, backup, inbound DMZ, outbound DMZ).
• Provision and maintain VLAN-segmented virtual networks strictly per the approved VLAN allocation table, ensuring excluded/reserved VLANs are never trunked, routed, or assigned.
• Configure the isolated, hypervisor-only public-worker network path and coordinate local segmentation controls without bypassing the enterprise-managed firewall policy.

Kubernetes Platform Engineering

• Deploy and manage a Kubernetes cluster with clearly segregated public-facing and private worker node groups, aligned to documented VLAN/subnet assignments.
• Implement default-deny NetworkPolicy, namespace isolation, and approved service/DNS exposure rules to prevent same-VLAN or cross-subnet API bypass.
• Enforce workload placement rules so public workloads run only on public worker nodes and private workloads only on private worker nodes (absent a documented, reviewed exception).
• Support cluster sizing, node scaling, health checks, and
• node/vNIC/port-group mapping documentation for the LLD registers.

Network Security & Segmentation

• Implement segmentation controls enforcing default-deny between zones (inbound DMZ, outbound DMZ, public workers, private workers, data zone, operations/backup).
• Coordinate with the enterprise-managed firewall/WAF/NAT team to submit, validate, and test required ingress and egress firewall rules, NAT policies, and stateful return-traffic rules.
• Configure controlled DNS resolution, FQDN/IP/port allowlists, and egress destination controls for outbound traffic.
• Support routing configuration across all zones per the approved route tables, ensuring no prohibited cross-role or cross-VLAN paths exist.

Validation, Testing & Documentation

• Execute the full validation test matrix (allowed and denied traffic paths) and capture evidence for security and architecture sign-off.
• Populate and maintain LLD records: firewall rules, route tables, NAT/DNS entries, VLAN allocation registers, and worker-node address assignments.
• Support resolution of outstanding TBD items (VM/node IPs, firewall rule IDs, NAT values, DNS/NTP entries) in coordination with Network, Platform, and Cybersecurity teams.
• Contribute to operational runbooks covering certificate lifecycle, backup/restore, monitoring, and incident escalation.

Operations & Monitoring

• Integrate WAF, firewall, APISIX, NGINX, Kubernetes, NAT, and DNS logs into the central logging/SIEM platform.
• Configure health checks, availability monitoring, and alerting for gateway, proxy, and Kubernetes service endpoints.
• Support high-availability planning and formally document single-host risk acceptance where applicable.