DevOps Engineer Cloud / AWS

Experience: Minimum 2 years in DevOps / Cloud Engineering

Location: Gurugram (Work from Office)

Employment Type: Full-time

Department: Platform DevOps

About the Role:

We are looking for a DevOps Engineer who understands how cloud infrastructure actually works at a systems level not just how to navigate a console. You will design, automate, secure, and operate our cloud platform on AWS, package and deploy applications using Kubernetes and Helm, and build the automation that lets our teams ship reliably and at scale.

The ideal candidate can reason about why a system behaves the way it does, debug issues from first principles, and make deliberate architectural and security trade-offs. We care more about depth of understanding than the length of a tool list. The role also works closely with our GenAI initiatives, so genuine curiosity and a willingness to learn GenAI tooling, infrastructure, and LLMOps is essential.

Key Responsibilities:

- Design, provision, and manage AWS infrastructure entirely as code using Terraform (or CloudFormation / CDK) with remote state management, reusable modules, workspaces, and reproducible multi-environment setups.

- Author, version, and maintain Helm charts for our services templating, values hierarchies, subcharts and dependencies, hooks, and release lifecycle management.

- Operate Kubernetes clusters (EKS or self-managed) including workload scheduling, resource requests/limits, autoscaling (HPA / Cluster Autoscaler / Karpenter), ingress, and network policies.

- Own CI/CD pipelines end to end build, test, artifact and image management, progressive deployments, canary/blue-green strategies, and reliable rollbacks.

- Design and harden AWS networking VPC architecture, subnetting, route tables, security groups vs. NACLs, VPC peering, Transit Gateway, NAT, VPC endpoints (interface/gateway), and Route 53 DNS resolution.

- Implement IAM at depth roles, policies, trust relationships, permission boundaries, least-privilege design, cross-account access, and IRSA (IAM Roles for Service Accounts) on EKS.

- Build observability across the stack metrics, structured logging, distributed tracing, dashboards, and meaningful alerting tied to SLOs/SLIs.

- Manage secrets and credentials securely (HashiCorp Vault / OpenBao / AWS Secrets Manager / equivalent) with rotation and least-privilege access.

- Drive cost visibility and optimisation, right-sizing, and capacity planning across the AWS footprint.

- Lead root-cause analysis on production incidents and improve system reliability and resilience.

Must-Have Technical Skills:

- Minimum 2 years of hands-on DevOps / Cloud Engineering experience.

- Deep AWS expertise able to explain how core services work internally, not just that they exist. We expect genuine fluency in areas such as:

1. IAM policy evaluation logic how allow/deny precedence, explicit denies, permission boundaries, and resource vs. identity policies resolve in practice.

2. VPC internals routing, DNS resolution, security groups vs. NACLs (stateful vs. stateless), and how to debug connectivity end to end.

3. EC2 / EKS networking, the ENI / CNI model, and how pods obtain and route IP addresses.

4. S3 access control (bucket policies, ACLs, IAM, pre-signed URLs), consistency model, encryption (SSE-S3/KMS), and lifecycle/storage classes.

5. Compute, storage (EBS volume types, IOPS), load balancing (ALB/NLB), and KMS-based encryption at rest and in transit.

- Infrastructure as Code production use of Terraform (or CloudFormation/CDK) including state, modules, drift management, and CI-driven plan/apply workflows.

- Kubernetes mandatory, in-depth deep, end-to-end Kubernetes expertise is a core requirement for this role. The candidate must be able to design, operate, secure, and debug clusters and workloads in production, with genuine understanding of how Kubernetes works under the hood:

1. Cluster architecture and internals control plane components (API server, etcd, scheduler, controller-manager), kubelet, kube-proxy, and the overall reconciliation/controller model.

2. Workloads and scheduling Deployments, StatefulSets, DaemonSets, Jobs/CronJobs; requests and limits, QoS classes, node affinity/anti-affinity, taints and tolerations, topology spread, and pod scheduling behaviour.

3. Networking the CNI model, Services (ClusterIP/NodePort/LoadBalancer), kube-proxy, Ingress controllers, in-cluster DNS, and NetworkPolicies; able to debug pod-to-pod and pod-to-external connectivity end to end.

4. Configuration and storage ConfigMaps, Secrets, PersistentVolumes/PVCs, StorageClasses, and stateful workload patterns.

5. Security RBAC, ServiceAccounts, IRSA on EKS, pod security standards/contexts, and secrets handling.

6. Scaling and reliability HPA/VPA, Cluster Autoscaler/Karpenter, liveness/readiness/startup probes, rolling updates and rollbacks, and graceful termination.

7. Operations and debugging fluent with kubectl, reading events and logs, diagnosing CrashLoopBackOff / ImagePullBackOff / OOMKilled / pending pods, and performing systematic root-cause analysis on live clusters (managed EKS and/or self-managed).

- Helm strong hands-on Helm chart authoring and maintenance: templating functions, values hierarchies and overrides, conditionals and ranges, named templates/helpers, subcharts and dependencies, hooks, and full release lifecycle management (install/upgrade/rollback) across environments.

- Docker (Containerisation) mandatory, in-depth deep end-to-end command of containers, not just running images. Must include: writing efficient, secure Dockerfiles; multi-stage builds; image layering, caching, and size optimisation; choosing and hardening base images (distroless / minimal); the container runtime model (namespaces, cgroups, union filesystems); image tagging and versioning strategy; working with registries (ECR or similar) including authentication and lifecycle policies; vulnerability scanning and image signing; managing volumes, networking, environment/config, and resource limits; and debugging container builds and runtime issues (entrypoints, init, exit codes, logs, exec into containers).

- CI/CD hands-on with GitLab CI, GitHub Actions, Jenkins, or similar, including pipeline-as-code.

- Observability strong hands-on experience operating a full observability stack (Prometheus, Grafana, OpenTelemetry, and a logging stack such as ELK / Loki / CloudWatch), including instrumenting services for metrics, structured logging, and distributed tracing, and building dashboards and actionable alerting tied to SLOs/SLIs.

- Linux & scripting strong Linux internals (processes, networking, systemd, permissions) and proficiency in Bash and ideally Python or Go.

- Version control strong Git proficiency and a clean, collaborative branching/review workflow.

- Willingness to learn GenAI & LLMOps genuine curiosity about GenAI tooling, LLM/RAG application infrastructure, and LLMOps practices (model serving, prompt/version management, evaluation, and observability), with eagerness to support GenAI workloads as the platform evolves.

Educational Qualifications:

- B.E. / B.Tech is mandatory in Computer Science, Information Technology, Electronics, or a related engineering discipline.

- Degree from a reputed / well-ranked engineering institution.

- Strong, consistent academic record with a good CGPA (typically 7.5+ / 10 or 70%+ across academics) and no significant gaps.

- Relevant cloud certifications (e.g. AWS Solutions Architect / SysOps / DevOps Engineer, CKA/CKAD) are a strong plus but are not a substitute for demonstrated hands-on depth.

Good to Have:

- Service mesh (Istio / Linkerd), advanced ingress, and Kubernetes network policies.

- GitOps tooling (ArgoCD / Flux) and policy-as-code (OPA / Kyverno).

- Security and compliance exposure ISO 27001, SOC 2, or similar frameworks.

- Experience supporting GenAI / LLM, data, or GPU-based workloads.

What We Value:

We value engineers who reason about infrastructure from first principles and can clearly explain the systems they have built and debugged. During the process you can expect a hands-on, scenario-based technical discussion focused on real-world depth rather than tool names or buzzwords.