Senior DevOps / Platform Engineer

🚀 About the Role

We are looking for a highly experienced Senior DevOps / Platform Engineer to join an ongoing enterprise data platform project running on AWS .

You will take ownership of critical platform components, ensuring they remain highly available, secure, resilient, and cost-efficient. The role involves delivering mandatory upgrades, lifecycle migrations, high-availability improvements, backup and recovery capabilities, and platform automation through Infrastructure as Code .

This is a hands-on senior position requiring strong production experience with AWS, Amazon EKS, Terraform/OpenTofu, Ansible, Kubernetes, PostgreSQL, GitLab, HashiCorp Vault, and Nexus . You will work with a high degree of technical autonomy while coordinating with platform owners, security teams, external providers, and production stakeholders.

🎯 Your Mission

As a Senior DevOps / Platform Engineer, you will:

• Keep a critical AWS-based data platform secure, available, and operationally resilient.
• Deliver complex platform upgrades and migrations without service disruption.
• Strengthen high availability, backup, recovery, monitoring, and self-healing capabilities.
• Maintain reusable and versioned Infrastructure as Code components.
• Improve production reliability while optimizing infrastructure capacity and cost.
• Remediate platform and IaC security vulnerabilities.
• Build sustainable operational procedures and transfer knowledge to internal teams.

💼 Key Responsibilities

Platform Upgrades & Lifecycle Management

• Plan and execute upgrades of self-hosted platform components, including:
• HashiCorp Vault
• GitLab
• Nexus Repository
• Jenkins
• Kafka
• Uptime Kuma
• Prepare backups, rollback procedures, maintenance plans, and post-upgrade validation steps.
• Coordinate production maintenance windows and technical approvals.
• Ensure that upgrades are completed safely and without service degradation.
• Manage version compatibility, dependencies, and end-of-life technology replacement.
• Produce clear evidence of successful upgrades and service continuity.

AWS & Amazon EKS Engineering

• Operate and continuously improve production workloads running on AWS.
• Upgrade Amazon EKS clusters, Kubernetes versions, and platform add-ons.
• Migrate EKS node groups from Amazon Linux 2 to Amazon Linux 2023 .
• Plan and implement upgrades with no disruption to running workloads.
• Manage and optimize AWS services including:
• Amazon EKS
• Amazon EC2
• Amazon S3
• AWS IAM
• Improve cluster availability, capacity, performance, and cost efficiency.
• Apply workload scheduling, resource rightsizing, and autoscaling practices.
• Evaluate and implement technologies such as Karpenter or Bottlerocket where appropriate.

Kubernetes Platform Management

• Operate production Kubernetes environments and core platform services.
• Configure and maintain:
• Helm charts
• Ingress controllers
• Readiness and liveness probes
• Horizontal Pod Autoscaling
• PodDisruptionBudgets
• Migrate the end-of-life ingress-nginx controller to a supported alternative without disrupting exposed services.
• Evaluate replacement options such as:
• AWS Load Balancer Controller
• Kubernetes Gateway API
• Traefik
• Improve workload resilience through automated restart, scaling, and remediation mechanisms.
• Troubleshoot complex Kubernetes, networking, deployment, and availability issues.

Infrastructure as Code

• Develop and maintain Infrastructure as Code using:
• Terraform
• OpenTofu
• Ansible
• Upgrade Terraform/OpenTofu versions and the AWS provider.
• Validate plans and demonstrate that proposed changes are non-destructive before applying them.
• Create reusable, tested, and versioned infrastructure modules.
• Apply semantic versioning to IaC components.
• Maintain automated tests, pipeline templates, tagging standards, and release documentation.
• Improve module quality, consistency, security, and maintainability.
• Support Terragrunt and automated IaC testing where applicable.

High Availability & Resilience

• Design and implement high availability for PostgreSQL.
• Plan and execute database failover tests.
• Evaluate and implement HA solutions such as:
• Patroni
• CloudNativePG
• Amazon RDS Multi-AZ
• Amazon Aurora Multi-AZ
• Strengthen the resilience of core platform components.
• Define availability actions for critical services.
• Validate that resilience improvements do not degrade service performance.
• Document failover behavior, dependencies, risks, and recovery procedures.

Backup, Restore & Disaster Recovery

• Maintain and test Kubernetes backup and recovery using Velero .
• Define backup policies for platform services and critical data.
• Regularly test restore procedures and document measured recovery times.
• Ensure backup and recovery procedures remain operational after platform upgrades.
• Improve disaster recovery readiness through repeatable tests and clear operational documentation.
• Support advanced backup strategies for GitLab, Vault, PostgreSQL, and Kubernetes components.

PostgreSQL Administration

• Administer and support PostgreSQL environments.
• Implement and validate backup and restore procedures.
• Design production-ready high-availability architectures.
• Perform database failover testing and document results.
• Support PostgreSQL monitoring, capacity planning, upgrades, and troubleshooting.
• Coordinate database changes with platform and application stakeholders.

Monitoring, Observability & Self-Healing

• Improve monitoring and alerting across infrastructure, Kubernetes, databases, and platform services.
• Build and maintain dashboards and alerts using:
• Prometheus
• Grafana
• Uptime Kuma
• Splunk
• Implement application and infrastructure health checks.
• Configure self-healing capabilities such as:
• Automated restarts
• Health probes
• Autoscaling
• Automated remediation
• Define and monitor relevant Service Level Indicators and Service Level Objectives.
• Improve troubleshooting through actionable metrics, logs, dashboards, and alerts.

Cost & Capacity Optimization

• Analyze and optimize EKS costs across pre-production and production environments.
• Apply rightsizing to Kubernetes workloads and underlying compute resources.
• Implement scheduled start and stop processes where appropriate.
• Use Kubecost or equivalent tooling to improve cost visibility.
• Identify unused, oversized, or inefficient resources.
• Balance cost optimization with availability, performance, and resilience requirements.

CI/CD & Release Governance

• Manage CI/CD workflows using GitLab and Jenkins.
• Work through GitLab merge requests, approval workflows, branch protection, and automated pipelines.
• Provide reusable pipeline templates for platform and Infrastructure as Code changes.
• Implement controlled and auditable delivery processes.
• Contribute to Jenkins Configuration as Code where applicable.
• Ensure platform releases follow appropriate testing, approval, and rollback procedures.

Security & Access Management

• Store and manage sensitive information securely using HashiCorp Vault.
• Apply least-privilege access principles across AWS, Kubernetes, GitLab, and supporting services.
• Implement and maintain:
• IAM policies
• Kubernetes RBAC
• TLS
• Segregation of duties
• Secure secrets management
• Remediate security findings identified by Checkmarx and Fortify.
• Ensure IaC modules and platform configurations follow internal security standards.
• Support integration with Active Directory where required.
• Improve software and infrastructure delivery without weakening governance or security controls.

Documentation & Operational Governance

• Produce technical designs for upgrades, migrations, HA, and resilience improvements.
• Write and maintain ITIL-aligned operational procedures covering:
• Platform upgrades
• Backup and recovery
• Monitoring and observability
• Incident response
• Maintenance activities
• Maintain documentation and monthly progress reports in Confluence.
• Record risks, dependencies, decisions, test evidence, and operational outcomes.
• Ensure support teams have the documentation required to operate the platform effectively.

Knowledge Transfer & Stakeholder Collaboration

• Take ownership of work already in progress and ensure continuity of delivery.
• Organize and conduct knowledge-transfer sessions.
• Collaborate with platform owners, application teams, security stakeholders, and third parties.
• Coordinate access requests, maintenance windows, production approvals, and technical dependencies.
• Communicate progress, risks, blockers, and recommendations clearly.
• Work within Scrum using two-week sprints, Jira, and Confluence.

✅ What We’re Looking For

Mandatory Requirements

• At least 5 years of experience in:
• DevOps
• Site Reliability Engineering
• Platform Engineering
• Cloud Infrastructure Engineering
• At least 3 years of production experience delivering Infrastructure as Code on AWS.
• Strong hands-on experience with Terraform and/or OpenTofu.
• Experience developing reusable and versioned IaC modules.
• Proven experience upgrading Terraform/OpenTofu and AWS providers safely.
• Strong Ansible experience.
• Production experience with Amazon EKS.
• Experience performing EKS version, add-on, and node group upgrades.
• Solid knowledge of Amazon EC2, Amazon S3, and AWS IAM.
• At least one successful EKS upgrade completed without downtime.
• Experience migrating a database to a high-availability setup without downtime.
• Strong knowledge of Kubernetes, including Helm, ingress controllers, probes, HPA, and PodDisruptionBudgets.
• PostgreSQL administration experience, including backup and restore.
• Experience upgrading self-hosted GitLab, Nexus, and HashiCorp Vault.
• Experience with Prometheus, Grafana, or equivalent monitoring platforms.
• Hands-on experience with Velero for Kubernetes backup and recovery.
• Experience with GitLab CI/CD and Jenkins.
• Strong understanding of IAM, RBAC, least privilege, Vault, and TLS.
• Advanced Linux administration and Bash scripting skills.
• Professional familiarity with Jira, Confluence, and VS Code.
• Fluent Portuguese and English.
• Ability to work with full technical autonomy.

🛠 Core Technical Stack

Cloud & Infrastructure

• AWS
• Amazon EKS
• Amazon EC2
• Amazon S3
• AWS IAM
• Amazon Linux 2
• Amazon Linux 2023

Infrastructure as Code

• Terraform
• OpenTofu
• Ansible
• Terragrunt
• Reusable IaC Modules
• Semantic Versioning
• Automated Module Testing

Kubernetes

• Kubernetes
• Helm
• Ingress Controllers
• Horizontal Pod Autoscaler
• PodDisruptionBudgets
• Health Probes
• Velero
• Karpenter
• Bottlerocket

Platform Services

• HashiCorp Vault
• GitLab
• Nexus Repository
• Jenkins
• Kafka
• Uptime Kuma

Databases

• PostgreSQL
• Patroni
• CloudNativePG
• Amazon RDS Multi-AZ
• Amazon Aurora Multi-AZ

Monitoring & Observability

• Prometheus
• Grafana
• Uptime Kuma
• Splunk
• Kubecost
• SLI/SLO Monitoring

CI/CD & Collaboration

• GitLab CI/CD
• Jenkins
• GitLab Merge Requests
• Branch Protection
• Jira
• Confluence

Security

• AWS IAM
• Kubernetes RBAC
• HashiCorp Vault
• TLS
• Checkmarx
• Fortify
• Least Privilege
• Segregation of Duties
• Active Directory

Development & Scripting

• Bash
• Linux
• Python
• Go

⭐ Nice to Have

• Experience with Terragrunt and automated IaC module testing.
• Previous migration from Amazon Linux 2 to Amazon Linux 2023.
• Experience with Karpenter or Bottlerocket.
• Migration experience from ingress-nginx to:
• AWS Load Balancer Controller
• Gateway API
• Traefik
• PostgreSQL HA experience using Patroni, CloudNativePG, RDS, or Aurora.
• Experience with Vault HA using Raft storage.
• Knowledge of GitLab Geo or advanced GitLab backup strategies.
• Experience implementing automated self-healing.
• Knowledge of Kubecost and Kubernetes rightsizing.
• Experience defining SLIs and SLOs.
• Jenkins Configuration as Code experience.
• Experience with Checkmarx, Fortify, and Active Directory integration.
• Development or automation experience with Python or Go.
• Exposure to data platform technologies such as:
• Kafka
• Airflow
• Apache NiFi
• Dremio
• RisingWave
• Apache Hive

🎓 Valued Certifications

• HashiCorp Certified: Terraform Associate
• HashiCorp Certified: Vault Associate
• AWS Certified SysOps Administrator
• AWS Certified Solutions Architect
• Certified Kubernetes Administrator
• ITIL 4 Foundation

🤝 Soft Skills

Autonomy & Ownership

• Comfortable taking complete ownership of complex platform activities.
• Ability to plan upgrades and migrations with limited supervision.
• Strong accountability for production stability and technical quality.

Risk Management

• Ability to anticipate upgrade, migration, recovery, and security risks.
• Methodical approach to backups, rollback plans, testing, and validation.
• Comfortable making decisions in business-critical production environments.

Problem Solving

• Strong troubleshooting and root cause analysis capabilities.
• Ability to resolve complex issues across AWS, Kubernetes, Linux, databases, and CI/CD.
• Focus on sustainable engineering solutions rather than temporary fixes.

Communication & Collaboration

• Clear communication with technical teams, platform owners, vendors, and approval stakeholders.
• Strong technical documentation and knowledge-transfer skills.
• Ability to coordinate maintenance activities across multiple parties.

Rigor & Continuous Improvement

• Strong attention to detail.
• Commitment to security, reliability, traceability, and operational excellence.
• Proactive approach to automation, standardization, and service improvement.