Senior DevOps / Platform Engineer

🚀 About the Role We are looking for a highly experienced Senior DevOps / Platform Engineer to join an ongoing enterprise data platform project running on AWS. You will take ownership of critical platform components, ensuring they remain highly available, secure, resilient, and cost-efficient. The role involves delivering mandatory upgrades, lifecycle migrations, high-availability improvements, backup and recovery capabilities, and platform automation through Infrastructure as Code. This is a hands-on senior position requiring strong production experience with AWS, Amazon EKS, Terraform/OpenTofu, Ansible, Kubernetes, PostgreSQL, GitLab, HashiCorp Vault, and Nexus. You will work with a high degree of technical autonomy while coordinating with platform owners, security teams, external providers, and production stakeholders. 🎯 Your Mission As a Senior DevOps / Platform Engineer, you will: - Keep a critical AWS-based data platform secure, available, and operationally resilient. - Deliver complex platform upgrades and migrations without service disruption. - Strengthen high availability, backup, recovery, monitoring, and self-healing capabilities. - Maintain reusable and versioned Infrastructure as Code components. - Improve production reliability while optimizing infrastructure capacity and cost. - Remediate platform and IaC security vulnerabilities. - Build sustainable operational procedures and transfer knowledge to internal teams. 💼 Key Responsibilities Platform Upgrades & Lifecycle Management - Plan and execute upgrades of self-hosted platform components, including: - HashiCorp Vault - GitLab - Nexus Repository - Jenkins - Kafka - Uptime Kuma - Prepare backups, rollback procedures, maintenance plans, and post-upgrade validation steps. - Coordinate production maintenance windows and technical approvals. - Ensure that upgrades are completed safely and without service degradation. - Manage version compatibility, dependencies, and end-of-life technology replacement. - Produce clear evidence of successful upgrades and service continuity. AWS & Amazon EKS Engineering - Operate and continuously improve production workloads running on AWS. - Upgrade Amazon EKS clusters, Kubernetes versions, and platform add-ons. - Migrate EKS node groups from Amazon Linux 2 to Amazon Linux 2023. - Plan and implement upgrades with no disruption to running workloads. - Manage and optimize AWS services including: - Amazon EKS - Amazon EC2 - Amazon S3 - AWS IAM - Improve cluster availability, capacity, performance, and cost efficiency. - Apply workload scheduling, resource rightsizing, and autoscaling practices. - Evaluate and implement technologies such as Karpenter or Bottlerocket where appropriate. Kubernetes Platform Management - Operate production Kubernetes environments and core platform services. - Configure and maintain: - Helm charts - Ingress controllers - Readiness and liveness probes - Horizontal Pod Autoscaling - PodDisruptionBudgets - Migrate the end-of-life ingress-nginx controller to a supported alternative without disrupting exposed services. - Evaluate replacement options such as: - AWS Load Balancer Controller - Kubernetes Gateway API - Traefik - Improve workload resilience through automated restart, scaling, and remediation mechanisms. - Troubleshoot complex Kubernetes, networking, deployment, and availability issues. Infrastructure as Code - Develop and maintain Infrastructure as Code using: - Terraform - OpenTofu - Ansible - Upgrade Terraform/OpenTofu versions and the AWS provider. - Validate plans and demonstrate that proposed changes are non-destructive before applying them. - Create reusable, tested, and versioned infrastructure modules. - Apply semantic versioning to IaC components. - Maintain automated tests, pipeline templates, tagging standards, and release documentation. - Improve module quality, consistency, security, and maintainability. - Support Terragrunt and automated IaC testing where applicable. High Availability & Resilience - Design and implement high availability for PostgreSQL. - Plan and execute database failover tests. - Evaluate and implement HA solutions such as: - Patroni - CloudNativePG - Amazon RDS Multi-AZ - Amazon Aurora Multi-AZ - Strengthen the resilience of core platform components. - Define availability actions for critical services. - Validate that resilience improvements do not degrade service performance. - Document failover behavior, dependencies, risks, and recovery procedures. Backup, Restore & Disaster Recovery - Maintain and test Kubernetes backup and recovery using Velero. - Define backup policies for platform services and critical data. - Regularly test restore procedures and document measured recovery times. - Ensure backup and recovery procedures remain operational after platform upgrades. - Improve disaster recovery readiness through repeatable tests and clear operational documentation. - Support advanced backup strategies for GitLab, Vault, PostgreSQL, and Kubernetes components. PostgreSQL Administration - Administer and support PostgreSQL environments. - Implement and validate backup and restore procedures. - Design production-ready high-availability architectures. - Perform database failover testing and document results. - Support PostgreSQL monitoring, capacity planning, upgrades, and troubleshooting. - Coordinate database changes with platform and application stakeholders. Monitoring, Observability & Self-Healing - Improve monitoring and alerting across infrastructure, Kubernetes, databases, and platform services. - Build and maintain dashboards and alerts using: - Prometheus - Grafana - Uptime Kuma - Splunk - Implement application and infrastructure health checks. - Configure self-healing capabilities such as: - Automated restarts - Health probes - Autoscaling - Automated remediation - Define and monitor relevant Service Level Indicators and Service Level Objectives. - Improve troubleshooting through actionable metrics, logs, dashboards, and alerts. Cost & Capacity Optimization - Analyze and optimize EKS costs across pre-production and production environments. - Apply rightsizing to Kubernetes workloads and underlying compute resources. - Implement scheduled start and stop processes where appropriate. - Use Kubecost or equivalent tooling to improve cost visibility. - Identify unused, oversized, or inefficient resources. - Balance cost optimization with availability, performance, and resilience requirements. CI/CD & Release Governance - Manage CI/CD workflows using GitLab and Jenkins. - Work through GitLab merge requests, approval workflows, branch protection, and automated pipelines. - Provide reusable pipeline templates for platform and Infrastructure as Code changes. - Implement controlled and auditable delivery processes. - Contribute to Jenkins Configuration as Code where applicable. - Ensure platform releases follow appropriate testing, approval, and rollback procedures. Security & Access Management - Store and manage sensitive information securely using HashiCorp Vault. - Apply least-privilege access principles across AWS, Kubernetes, GitLab, and supporting services. - Implement and maintain: - IAM policies - Kubernetes RBAC - TLS - Segregation of duties - Secure secrets management - Remediate security findings identified by Checkmarx and Fortify. - Ensure IaC modules and platform configurations follow internal security standards. - Support integration with Active Directory where required. - Improve software and infrastructure delivery without weakening governance or security controls. Documentation & Operational Governance - Produce technical designs for upgrades, migrations, HA, and resilience improvements. - Write and maintain ITIL-aligned operational procedures covering: - Platform upgrades - Backup and recovery - Monitoring and observability - Incident response - Maintenance activities - Maintain documentation and monthly progress reports in Confluence. - Record risks, dependencies, decisions, test evidence, and operational outcomes. - Ensure support teams have the documentation required to operate the platform effectively. Knowledge Transfer & Stakeholder Collaboration - Take ownership of work already in progress and ensure continuity of delivery. - Organize and conduct knowledge-transfer sessions. - Collaborate with platform owners, application teams, security stakeholders, and third parties. - Coordinate access requests, maintenance windows, production approvals, and technical dependencies. - Communicate progress, risks, blockers, and recommendations clearly. - Work within Scrum using two-week sprints, Jira, and Confluence. ✅ What We’re Looking For Mandatory Requirements - At least 5 years of experience in: - DevOps - Site Reliability Engineering - Platform Engineering - Cloud Infrastructure Engineering - At least 3 years of production experience delivering Infrastructure as Code on AWS. - Strong hands-on experience with Terraform and/or OpenTofu. - Experience developing reusable and versioned IaC modules. - Proven experience upgrading Terraform/OpenTofu and AWS providers safely. - Strong Ansible experience. - Production experience with Amazon EKS. - Experience performing EKS version, add-on, and node group upgrades. - Solid knowledge of Amazon EC2, Amazon S3, and AWS IAM. - At least one successful EKS upgrade completed without downtime. - Experience migrating a database to a high-availability setup without downtime. - Strong knowledge of Kubernetes, including Helm, ingress controllers, probes, HPA, and PodDisruptionBudgets. - PostgreSQL administration experience, including backup and restore. - Experience upgrading self-hosted GitLab, Nexus, and HashiCorp Vault. - Experience with Prometheus, Grafana, or equivalent monitoring platforms. - Hands-on experience with Velero for Kubernetes backup and recovery. - Experience with GitLab CI/CD and Jenkins. - Strong understanding of IAM, RBAC, least privilege, Vault, and TLS. - Advanced Linux administration and Bash scripting skills. - Professional familiarity with Jira, Confluence, and VS Code. - Fluent Portuguese and English. - Ability to work with full technical autonomy. 🛠 Core Technical Stack Cloud & Infrastructure - AWS - Amazon EKS - Amazon EC2 - Amazon S3 - AWS IAM - Amazon Linux 2 - Amazon Linux 2023 Infrastructure as Code - Terraform - OpenTofu - Ansible - Terragrunt - Reusable IaC Modules - Semantic Versioning - Automated Module Testing Kubernetes - Kubernetes - Helm - Ingress Controllers - Horizontal Pod Autoscaler - PodDisruptionBudgets - Health Probes - Velero - Karpenter - Bottlerocket Platform Services - HashiCorp Vault - GitLab - Nexus Repository - Jenkins - Kafka - Uptime Kuma Databases - PostgreSQL - Patroni - CloudNativePG - Amazon RDS Multi-AZ - Amazon Aurora Multi-AZ Monitoring & Observability - Prometheus - Grafana - Uptime Kuma - Splunk - Kubecost - SLI/SLO Monitoring CI/CD & Collaboration - GitLab CI/CD - Jenkins - GitLab Merge Requests - Branch Protection - Jira - Confluence Security - AWS IAM - Kubernetes RBAC - HashiCorp Vault - TLS - Checkmarx - Fortify - Least Privilege - Segregation of Duties - Active Directory Development & Scripting - Bash - Linux - Python - Go ⭐ Nice to Have - Experience with Terragrunt and automated IaC module testing. - Previous migration from Amazon Linux 2 to Amazon Linux 2023. - Experience with Karpenter or Bottlerocket. - Migration experience from ingress-nginx to: - AWS Load Balancer Controller - Gateway API - Traefik - PostgreSQL HA experience using Patroni, CloudNativePG, RDS, or Aurora. - Experience with Vault HA using Raft storage. - Knowledge of GitLab Geo or advanced GitLab backup strategies. - Experience implementing automated self-healing. - Knowledge of Kubecost and Kubernetes rightsizing. - Experience defining SLIs and SLOs. - Jenkins Configuration as Code experience. - Experience with Checkmarx, Fortify, and Active Directory integration. - Development or automation experience with Python or Go. - Exposure to data platform technologies such as: - Kafka - Airflow - Apache NiFi - Dremio - RisingWave - Apache Hive 🎓 Valued Certifications - HashiCorp Certified: Terraform Associate - HashiCorp Certified: Vault Associate - AWS Certified SysOps Administrator - AWS Certified Solutions Architect - Certified Kubernetes Administrator - ITIL 4 Foundation 🤝 Soft Skills Autonomy & Ownership - Comfortable taking complete ownership of complex platform activities. - Ability to plan upgrades and migrations with limited supervision. - Strong accountability for production stability and technical quality. Risk Management - Ability to anticipate upgrade, migration, recovery, and security risks. - Methodical approach to backups, rollback plans, testing, and validation. - Comfortable making decisions in business-critical production environments. Problem Solving - Strong troubleshooting and root cause analysis capabilities. - Ability to resolve complex issues across AWS, Kubernetes, Linux, databases, and CI/CD. - Focus on sustainable engineering solutions rather than temporary fixes. Communication & Collaboration - Clear communication with technical teams, platform owners, vendors, and approval stakeholders. - Strong technical documentation and knowledge-transfer skills. - Ability to coordinate maintenance activities across multiple parties. Rigor & Continuous Improvement - Strong attention to detail. - Commitment to security, reliability, traceability, and operational excellence. - Proactive approach to automation, standardization, and service improvement.