Devops Engineer

Role & responsibilities

• Own infrastructure as code in Terraform for the full landing zone: IAM, VPC and subnets, firewall rules, Cloud NAT, global HTTPS load balancing (ALB and NLB), Cloud Armor, private regional GKE clusters and node pools, Compute Engine, Cloud Storage, Persistent Disk, Cloud SQL, Memorystore, Cloud KMS, Secret Manager, Artifact Registry, and Cloud DNS, with environments reproducible from an empty project.
• Accept the handover from our migration partner, validate every deliverable against the scope, and close the gaps they excluded: application process monitoring and alerting, runbooks, and day-two operations.
• Complete the migration: ECS workloads to GKE, S3 data to Cloud Storage via Storage Transfer Service, remaining VMs, and the DNS cutover to the new load balancer.
• Operate GKE well: namespaces, Kubernetes service accounts and RBAC, workload identity, cluster and node-pool autoscaling, ingress, upgrades without downtime, and GPU node pools with vLLM for open-weight models.
• Run the data services: MongoDB Atlas from the GCP Marketplace, Confluent Cloud Kafka, Debezium on GKE, Memorystore Redis, and Cloud SQL, including backups, restore tests, and disaster recovery.
• Build CI/CD with Cloud Build and GitHub Actions and Argo CD, with images and packages in Artifact Registry, signed images, SBOMs, and vulnerability scanning in the pipeline.
• Run the observability stack: OpenTelemetry collectors, Cloud Logging and Cloud Monitoring, Prometheus and Grafana, VPC Flow Logs, and per-tenant cost and token telemetry.
• Drive cost engineering: spot and preemptible node pools, autoscaling to zero, committed-use discounts, right-sizing the n2d and highmem pools, and a FinOps dashboard the founders check weekly.
• Implement and maintain the enterprise security baseline: organization policies (public access prevention, no external IPs, no service-account keys or uploads, uniform bucket-level access, restricted serial port access, trusted images only, no default network), least-privilege IAM, CMEK with Cloud KMS, Secret Manager, VPC Service Controls, Private Service Connect, SSO, CIS benchmarks, and SOC 2 evidence.
• Produce deployment blueprints for AKS and EKS and validate them with a real customer deployment.
• Define SLOs, run incident response, and write the postmortems.

Preferred candidate profile

• 5 to 8 years in DevOps, SRE, or platform engineering, with production depth on Google Cloud.
• Kubernetes beyond the basics: private GKE, networking and ingress, autoscaling, workload identity, upgrades without downtime.
• Terraform as your primary language for infrastructure, plus Python or Bash for everything else.
• Cloud networking you can draw from memory: VPCs and subnets, NAT, firewall rules, load balancer tiers, private DNS, and how a WAF sits in front of all of it.
• Operating at least one of Kafka, MongoDB, or Redis in production, and a habit of testing backups by restoring them.
• Observability as a practice, not a product install.
• Exposure to compliance work: SOC 2, ISO 27001, or customer security reviews.
• Experience taking over infrastructure built by someone else and making it yours.