Platform Engineer – MS1 “Phoenix Platform”

The Mission

The MS1 “Phoenix Platform” is the engine room of the BSH XaaS Cloud. We are building

the multi-tenant platform layer (Managed Hosting Platform and Managed Runtime) that

internal developer teams use to ship applications onto AWS EKS without having to manage

the underlying infrastructure.

This is a true platform engineering role. You won’t just be running applications on EKS;

you will be building the platform that other developers consume. You will create reusable

tools, design tenant isolation, build CI/CD pipelines, and manage the observability surface to

empower application teams.

Core Responsibilities

• Developer Enablement: Act as the primary technical guide for application teams

  onboarding to the platform.

• Documentation & Training: Create clear tutorials, runbooks, and lead hands-on

  workshops covering platform features, CI/CD, and modern DevOps practices.

• Pipeline Engineering: Build and maintain secure, reusable CI/CD pipeline templates

  (GitHub Actions).

• GitOps & Helm: Manage GitOps with Argo CD and author reusable Helm chart

  templates. You will treat these charts as a product for tenant teams, not just consume

  existing ones.

• Quality & Security Gates: Integrate automated security scanning (SAST/DAST) and

  compliance checks into the delivery lifecycle.

• Release Management: Advise on zero-downtime deployment strategies, including

  Blue/Green and Canary releases.

• Troubleshooting: Provide expert-level support for complex EKS runtime issues,

  including resource limits, ingress routing, and secrets management.

  Must-Have Skills (The Baseline)

  To succeed in this role, you must have a strong foundation in EKS application lifecycles and

  proven experience building multi-tenant platforms.

• Kubernetes & EKS: Deep ability to run, scale, and debug applications on K8s/EKS.

• CI/CD Automation: Proven experience building reusable pipelines, ideally with

  GitHub Actions (GitLab CI or Jenkins is acceptable).

• GitOps Tooling: Hands-on experience with Argo CD and Helm.

• Platform Architecture: Expertise in authoring complex, parameterized Helm chart

  templates.

• Multi-Tenant Security: Ability to design Kubernetes RBAC, ResourceQuotas, and

  NetworkPolicies to safely isolate multiple teams on shared clusters.

• Identity & Ingress: Experience integrating OAuth2/OIDC, SSO, and handling

  advanced path-based routing, rate limiting, and streaming endpoints.

• Observability: Hands-on experience building actionable Prometheus, Grafana, and

  AlertManager dashboards and alerts.

• Scripting: Proficiency in Python, Bash, or Go for developer-facing automation.

• Supply-Chain Security: Experience implementing blocking vulnerability scans

  (OWASP, Trivy) in CI pipelines.

  Nice-to-Have Skills (Differentiators)

• Experience managing Harbor registries and API gateways (Kong or Nginx).

• Familiarity with managing secrets at scale (IRSA, AWS Secrets Manager, External

  Secrets).

• Experience with DataDog APM / Grafana APM (our designated observability

  standard).

• A strong understanding of Service Level Objectives (SLOs) and incident-response

  judgment.

• Experience building self-service onboarding templates (e.g., Cookiecutter).

• Familiarity with SAFe or PI-cadence environments and cross-geo collaboratio