Role Summary :

The DevOps Architect owns the decisions that outlive any single deployment - the reference architectures, standards, infrastructure BOMs, and CI/CD and security patterns that every PrivaSapien banking and enterprise deployment inherits. Where a Senior DevOps Engineer is accountable for operating one enterprise's estate excellently, the Architect is accountable for designing how PrivaSapien deploys on ANY enterprise's estate so that a new customer is a configuration exercise, not a redesign, directly enabling the product's rapid deployment goals.

The role is equally technical and consultative. Internally, it interacts with PrivaSapien Engineering to determine deployment options for each product component and translates them into deployable architectures. Externally, it holds architecture-level discussions with the client's network, cloud, and security teams - owning the architecture diagram that a enterprise's security and infrastructure committees interrogate before approving a deployment. It guides and develops the medium and senior DevOps engineers who operate the resulting estates.

Key Responsibilities - Architecture & Design :

- Own the PrivaSapien reference architecture for banking and large-enterprise deployments - deployment topology, high-availability and DR patterns, multi-environment (UAT/DC/DR) design, multi-tenancy model, and substrate strategy (AWS/EKS, OpenStack private cloud, bare-metal) - so that all accounts are variants of one coherent architecture rather than bespoke builds.

- Interact with PrivaSapien Engineering to determine the deployment options for each product component - the Consent engine, DPR portal, Enterprise Tree service, integration APIs, the data layer (RDS/PostgreSQL, MongoDB, Kafka, Redis), Vault, and GPU inference workloads - and translate those options into concrete, deployable architectures with clear trade-offs.

- Build deployable architectures, not diagrams alone - reference Helm/Kustomize structures, IaC module libraries (Terraform), golden cluster configurations, and environment-parity overlays that the account DevOps teams execute directly.

- Own the non-functional requirement targets - scalability ceilings, RTO/RPO patterns, latency budgets, throughput models for consent-event volume - and design the architecture to meet them provably.

- Make and defend technology-selection and lifecycle decisions - ingress and service-mesh choices, secrets architecture (Vault vs cloud-native), autoscaling strategy, component end-of-life and migration planning - as multi-year bets with documented cost and risk rationale.

Key Responsibilities - Infrastructure BOM & Cost Justification :

- Propose the infrastructure Bill of Materials for each deployment - compute, memory, storage tiers and IOPS classes, GPU nodes, network, and licensing footprint - sized to the customer's scale and the three-environment (UAT/DC/DR) model.

- Justify every BOM line with cost rationale - sizing formulas per customer tier, GPU capacity economics, storage class trade-offs, and the cost implications of HA/DR choices - so that the BOM is defensible to both the enterprise's procurement and PrivaSapien's commercial team.

- Design the cost architecture, not just monitor cost - establish the 'standard deployment BOM' and its cost envelope that feeds pre-sales sizing, RFP responses, and the Machine & Software Pre-Requisite Specification.

- Produce deployment sizing for RFP and pre-sales - translate a prospect's stated scale and architecture into a credible infrastructure footprint and cost estimate before contract.

Key Responsibilities - Security & CI/CD :

- Own the security architecture of the deployment within OEM scope - image signing and SBOM strategy, admission-control and Pod Security posture, network segmentation and NetworkPolicy design, secrets architecture, and the evidence model that satisfies a enterprise's security committee and RBI-aligned audit.

- Design and mature the CI/CD architecture - multi-environment promotion (UAT - DC - DR), changegate integration with enterprise CAB processes, DevSecOps controls (scanning, signing, IaC and secrets scanning), and GitOps patterns - as a repeatable pipeline standard, not a per-account build.

- Define the CI/CD toolchain STANDARD across accounts - orchestrator selection (GitLab CI, Jenkins, GitHub Actions, or AWS CodePipeline/CodeBuild), GitOps engine (ArgoCD/FluxCD), registry (Amazon ECR or Harbor for air-gapped), Helm/Kustomize packaging, and the DevSecOps gate stack (Trivy/Aqua/Prisma scanning, cosign signing, syft/grype SBOM, tfsec/Checkov, gitleaks, SonarQube/OWASP ZAP) - and make toolchain lifecycle decisions (e.g. Jenkins/GitLab migration, ArgoCD adoption) with documented cost/risk rationale.

- Understand and design to the enterprise's security constraints - air-gapped or restricted-registry environments, SFTP-scanned image transfer, PIM/bastion access models, data localisation, and encryption posture - so security is architected in, not retrofitted.

Key Responsibilities - Client Architecture Engagement :

- Hold architecture-level discussions with the client's NETWORK team - connectivity design (Direct Connect/Transit Gateway or on-prem equivalents), DNS and resolver strategy, MTU/overlay considerations, firewall and segmentation requirements - and own the connectivity requirements PrivaSapien hands over.

- Hold architecture-level discussions with the client's CLOUD team - landing-zone integration, account and IAM boundary design, service quotas, managed-service adoption under the enterprise's cloud-outsourcing guidelines - as the OEM's technical counterpart.

- Hold architecture-level discussions with the client's SECURITY team - presenting and defending the deployment architecture in security review boards, addressing findings at design level, and aligning on the compliance evidence model before deployment begins.

- Own the architecture diagram the client's committees interrogate - keep it current, accurate, and defensible, and represent PrivaSapien credibly in win-the-deal and pass-the-review forums.

- Understand complex enterprise and large-enterprise architectures - core banking, digital channels, data warehouse, middleware, APIM, and identity layers - well enough to design PrivaSapien's integration into them and to anticipate where deployment friction will arise.

Key Responsibilities - Team Leadership, Process & Commercial :

- Provide overall technical leadership of the DevOps function and its team leads across accounts - set direction and standards, own the capability roadmap, and hold the team leads accountable for consistent execution against the reference architecture. (Operational line-management and rostering remain with account delivery leads; this role owns the technical and standards authority over them.)

- Establish internal engineering processes and drive automation of deployments and CI/CD pipelines for both internal environments and external (customer) deployments - reducing manual effort, deployment time, and error rates, and directly advancing the product's rapid-deployment capability.

- Facilitate tooling and infrastructure procurement needed to scale deployment capacity - evaluate and specify the CI/CD, security, and platform tooling, justify it commercially, and support the procurement process with technical requirements and vendor assessment.

- Prepare and negotiate technical proposals within the DevOps and deployment domain - solution designs, infrastructure BOMs, and scope/effort estimates - and represent the technical position in client and commercial negotiations.

- Helps in scaling up and setting up teams for large number of deployments in various modes. On-premise and remote.

- Setup customer infra support team for 9x5 or 24x7 operations for on-premise and remote support mode.

Key Responsibilities - Guidance & Governance :

- Guide and develop medium and senior DevOps engineers - run design reviews, set engineering standards, and raise the operating team's architectural judgment; the Architect develops the Seniors as the Seniors develop the Mids.

- Own the post-incident architectural remediation - where a P1 exposes a design weakness, own the permanent architectural fix, not the operational workaround.

- Arbitrate cross-functional architecture decisions - whether a customer customisation becomes a reusable product pattern or a one-off overlay - in coordination with Engineering and Product.

- Maintain the reference-architecture and standards library, versioned, so improvements propagate across all accounts and every new deployment starts from the current best pattern.

Required Skills & Qualifications :

- Deep, demonstrable cloud architecture on AWS, and bare-metal Kubernetes (for on-premise deployment) (Experience of OpenStack cloud would be an added advantage) - VPC and hybrid network design, IAM architecture, EKS design at scale, storage and data-service selection, and multi-region/DR topologies. Experience in other cloud like Azure/ GCP is an added advantage.

- Expert Kubernetes architecture - cluster design (managed and self-managed), multi-tenancy, ingress and service-mesh selection, autoscaling strategy, and stateful-workload design for HA data systems.

- Infrastructure-as-Code architecture - Terraform module design, reusable IaC libraries, and GitOps patterns as standards, not scripts.

- Mature CI/CD design - multi-environment promotion pipelines with an orchestrator (GitLab CI/Jenkins/GitHub Actions/CodePipeline) and GitOps engine (ArgoCD/FluxCD), Helm/Kustomize packaging, registry strategy (ECR/Harbor), DevSecOps gate integration (image scanning, cosign signing, SBOM, tfsec/Checkov, gitleaks, SAST/DAST), and change-management integration with enterprise CAB processes.

- Security architecture - image supply-chain security, admission control and Pod Security Standards, network segmentation, secrets architecture (HashiCorp Vault and cloud-native), and audit-evidence design for regulated environments.

- Infrastructure sizing and cost modelling - BOM construction, capacity planning, cost-optimisation architecture, and the ability to justify infrastructure spend to procurement and commercial stakeholders.

- Data-platform architecture literacy - RDS/PostgreSQL, MongoDB, Kafka, Redis, object storage, and Vault at a design level, sufficient to architect the data tier and direct the Data & Vault Platform Engineers.

- Ability to understand and design into complex enterprise architectures - core banking systems, digital channels, APIM, identity, and data platforms - common in banking and large enterprises.

- Strong stakeholder command - able to hold and lead architecture discussions with a enterprise's network, cloud, and security teams, and to defend design decisions in a security review board.

- Retained hands-on credibility - able to prototype, read code and IaC, and overrule a poor design with working evidence rather than authority alone.

Preferred Certifications :

- AWS Certified Solutions Architect - Professional - AWS Certified DevOps Engineer - Professional

- Certified Kubernetes Administrator / Security Specialist (CKA/CKS)

- HashiCorp Terraform Associate / Vault Associate - relevant security certifications (e.g. CISSP-adjacent knowledge) valued for the security-review dimension

- Willingness to do OEM Product Certification.

- Willingness to DPDP Act refresher certification - within 30 days of hire