About the role
- Make deployments fast and automatic. Build GitHub Actions pipelines that take a merged PR to production in minutes. No manual server steps, and a one-click rollback.
- Gate every release on tests. Run unit, integration and smoke tests, plus lint and security scans, inside the pipeline. A failing test blocks the deploy, and a failed health check rolls it back automatically.
- Run Kubernetes on EKS. Own our EKS clusters, Helm charts and ArgoCD GitOps flow. Lead the move of the API, workers and cron jobs from EC2, PM2 and ECS onto EKS with zero downtime.
- Integrate other providers. Deploy and connect services across AWS and managed providers such as ClickHouse Cloud, MongoDB, Redis, and our messaging and payment vendors. Handle networking, private connectivity, secrets and IP allowlists.
- Follow best practices. Infrastructure as code for everything, least-privilege IAM, OIDC instead of long-lived keys, separate dev, staging and production environments, and documented runbooks.
- Scale the system. Tune autoscaling for pods, nodes, ECS tasks, Lambda concurrency and SQS-driven workers, so we absorb traffic spikes without paying for idle capacity.
- Own backups and recovery. Set backup policies for MongoDB, ClickHouse, S3 and cluster state. Define recovery time and recovery point targets, and run restore drills on a schedule so backups are proven, not assumed.
- Cut AWS cost. Track spend by service and environment, right-size instances, use Savings Plans and Spot where safe, set S3 lifecycle rules and log retention, remove idle resources, and report monthly savings in numbers.
- Monitor and alert. Build Datadog and CloudWatch dashboards and alerts for latency, error rates, queue depth, consumer lag and disk, each with an owner and a runbook.
- Prioritise and follow through. Triage the DevOps backlog and incoming alerts by impact, act on the highest-priority items first, and follow up with each owner until the fix ships and the postmortem actions are closed.
How you'll prioritiseYou'll run the DevOps queue against clear priority levels. Every item has an owner, a next step and a follow-up date until it's closed.PriorityExampleFirst responseFollow-up until closedP0: outage or data at riskAPI down, failed deploy in production, a backup missing, a security exposureWithin 15 minutes, any hourFix now, update stakeholders every 30 minutes, postmortem within 2 working daysP1: degraded serviceHigh error rate, queue backlog growing, consumer lag, disk above 85%Within 1 hourFix the same day, then a root-cause ticket with an ownerP2: risk or wasteCost spike, noisy alert, slow pipeline, flaky deploy test, an unpatched imageWithin 1 working dayPlanned into the current sprint, with a weekly status checkP3: improvementAutomation, documentation, tooling upgradesWeekly triageRanked in the backlog by impact against effort
Each week you'll share a short ops report: open P0 and P1 items, their owners, the overdue items, cost against the previous month, and what you closed.What you bring
- 3+ years in DevOps, SRE or platform engineering, running production workloads on AWS that customers depend on.
- Kubernetes on EKS in production. Deployments, HPA and cluster or node autoscaling (Karpenter or Cluster Autoscaler), ingress, IRSA or Pod Identity, resource limits, and upgrading a cluster without downtime.
- Helm and GitOps. You've written and maintained Helm charts and run ArgoCD or Flux, with promotion from dev to staging to production.
- CI/CD pipelines. GitHub Actions (or GitLab CI or Jenkins) with test gates, Docker image builds, caching, environment approvals, and blue-green, canary or rolling releases with automatic rollback.
- Infrastructure as code. Terraform, CDK or CloudFormation for real environments, with state management and reviewed plans before apply.
- AWS breadth. VPC networking, IAM, EC2 and Auto Scaling, ECS, Lambda, S3, SQS, Kinesis, CloudWatch, SSM and Secrets Manager, Route 53 and load balancers.
- Backups and disaster recovery. You've set up backups and actually restored from them, and you can explain the recovery time and recovery point you achieved.
- AWS cost optimisation. You've cut a real AWS bill and can show the numbers, using Cost Explorer, tags, right-sizing, Savings Plans, Spot and lifecycle policies.
- Monitoring and on-call. Datadog, Prometheus/Grafana or CloudWatch. You build dashboards, write alerts that don't cry wolf, and lead incidents calmly.
- Linux and scripting. Strong Bash, plus Python or Node.js for automation.
- Ownership and follow-through. You prioritise by impact, chase blockers across teams, and close the loop in writing.
- Plan before apply. The agent proposes a change, you read the diff and the plan, and the change ships through a PR and GitOps, never straight to production.
- Least privilege for agents too. Read-only AWS and cluster access by default, no credentials in prompts, and audit logs on.
- Verify, don't trust. A pipeline is fixed when it passes on a real run, and a backup is good when a restore succeeds.
- Codify the runbooks. Turn repeated incident steps into project skills and CLAUDE.md notes so the next person resolves it faster.
- Kubernetes on other providers (GKE, AKS) or a multi-cloud setup
- A migration you led from EC2 or ECS to EKS without downtime
- Running or backing up stateful data services: MongoDB (replica sets, Atlas), ClickHouse, Redis
- Event-driven systems in production: Kinesis shard scaling, SQS dead-letter queues, Lambda concurrency limits
- Policy and security tooling: OPA/Kyverno, Trivy or ECR image scanning, AWS GuardDuty, Security Hub
- FinOps practice: tag-based cost allocation, budgets and anomaly alerts, Kubecost
- AWS certifications (Solutions Architect, DevOps Engineer Professional) or CKA/CKAD
- Claude Code skills, hooks or automation you've built for infrastructure work