Responsibilities
Own and evolve our CI/CD platform: GitHub Actions with self-hosted runners (RunsOn), plus an in-progress migration and refactor of our Jenkins setup ("Jenkins Next").
Build and maintain Infrastructure as Code across AWS using Terraform / Terragrunt / Terramate, following reusable component patterns (CloudPosse-style).
Design secure-by-default delivery pipelines: branch protection and PR approval rulesets, secrets management (SOPS), and prod-approval flows for critical paths.
Drive our move from IAM users and long-lived access keys toward IAM roles, and help close foundational security gaps (open ports, unmanaged credentials, missing guardrails).
Work with Kubernetes (EKS), Helm, and ArgoCD, and support our observability stack (Grafana, Prometheus) and developer platform (Backstage).
Review and improve existing components — Terraform, pipelines, AWS infra — not only build new ones, and raise the bar on how the team delivers.
Share the support/triage load and help reduce it through better automation and tooling.
Requirements
Strong AWS experience and deep hands-on CI/CD expertise (GitHub Actions and/or Jenkins).
Solid Infrastructure as Code background with Terraform (Terragrunt / Terramate a plus).
Real Kubernetes / EKS experience, including Helm and GitOps (ArgoCD).
A security-conscious mindset — comfortable reasoning about IAM, secrets, network exposure, and least-privilege access (a DevSecOps lean is a strong plus).
The ability to design a solution, then adapt gracefully when constraints change ("now make it global", "now cost is the primary driver") — digging for context rather than getting flustered.
Sound judgment on edge cases and incidents: traffic spikes 10x, a region goes down — how do you approach the change and handle the outage?
Effective, deliberate use of AI tooling, with genuine understanding of what it produces and the ability to explain trade-offs it can't.
