DevOps Engineer

WE ARE

StartupSoft connects top Ukrainian engineers with world-class startups from Silicon Valley and EU. Our developers work directly on the product as an integral part of the startup team.

PROJECT DESCRIPTION

The project is a digital financial services platform designed to support secure and efficient transactions for individuals and businesses. The platform provides solutions that simplify financial operations and improve everyday digital experiences. It integrates with various external systems and organizations to streamline processes, enhance usability, and maintain high standards of security, privacy, and reliability.

STAGE

Live product

STACK ON THE PROJECT

AWS/Azure, Cloud Security, IAM/RBAC, Vulnerability Remediation, Cloud Networking, Resilience & Disaster Recovery, Dynatrace/Splunk/CloudWatch/Azure Monitor, Python/Bash/PowerShell, Terraform, Kubernetes (AKS/EKS), Linux.

TEAM

Mostly located in Canada

Requirements:

• Three or more years of hands-on experience in cloud platform engineering, cloud security engineering, infrastructure engineering, DevSecOps, site reliability engineering, cloud operations engineering, or a comparable role supporting business-critical distributed platforms.
• Deep practical expertise in either Azure or AWS platform engineering, together with working knowledge of the alternate cloud platform sufficient to support security hardening, resilience engineering, recovery validation, migration activities, troubleshooting, documentation, and backup coverage.
• Strong hands-on experience implementing and maintaining cloud security controls, secure platform configurations, security baselines, cloud policies, configuration controls, and secure-by-default engineering patterns.
• Strong practical knowledge of identity and access management, including RBAC, managed identities, Microsoft Entra ID, AWS IAM, privileged-access controls, cloud-native workload identities, service principals, roles, policies, secrets, certificates, and access-review practices.
• Strong understanding of cloud networking and network security controls, including virtual networks or VPCs, subnets, routing, firewalls, network security groups or security groups, private connectivity, name resolution, load balancing, ingress and egress controls, and network-policy enforcement.
• Experience implementing and validating approved virtual-machine and container image standards, image hardening, image lifecycle controls, configuration compliance, and remediation of non-compliant platform components.
• Demonstrated experience coordinating and executing vulnerability remediation across cloud services, operating systems, virtual-machine images, containers, managed Kubernetes platforms, middleware, and infrastructure components.
• Experience supporting patching initiatives, collecting security evidence, validating compliance controls, documenting remediation outcomes, and contributing to platform-control reviews in a regulated environment.
• Experience with enterprise monitoring and observability across logs, metrics, traces, alerts, dashboards, and telemetry integrations using tools such as Dynatrace, Splunk, Azure Monitor, CloudWatch, and ServiceNow.
• Demonstrated hands-on experience engineering platform availability, fault tolerance, capacity, scalability, recovery readiness, and single-point-of-failure remediation, including recovery validation, resilience testing, disaster-recovery planning and exercises, failure-scenario analysis, documented assessments, and controlled remediation.
• Proficiency in PowerShell, Bash, Python, or equivalent scripting and automation, with source-control, testing, reusable-code, security, maintainability, and auditability practices.
• Strong troubleshooting skills across Linux, cloud services, APIs, microservices, containers, Kubernetes, databases, middleware, configuration, performance, and distributed dependencies.
• Demonstrated ability to investigate complex platform incidents and recurring problems, isolate security, infrastructure, and runtime fault domains, assess engineering risk, implement controlled remediation, validate recovery, and coordinate effectively with AppOps, Development, Security, Release Management, and enterprise platform teams.
• Working knowledge of Terraform-based infrastructure, environment provisioning, cross-cloud provisioning patterns, platform-readiness validation, AKS or EKS, and runtime services sufficient to provide assigned backup coverage; these are supporting rather than primary qualifications.
• Clear written and verbal communication, disciplined documentation, and the ability to collaborate across time zones in a regulated production environment.

Nice to Have

• Experience supporting payment, financial-services, or other high-volume, high-availability systems.
• Knowledge of database operations, distributed tracing, resilience testing, and automated recovery.
• Experience building modular operational libraries, self-service capabilities, inner-source assets, or self-healing mechanisms used across multiple products.
• Additional experience applying GitHub Actions, Jenkins, or Dynatrace to deployment validation, alerting, dashboards, reporting, and operational evidence is preferred.

Responsibilities:

Primary Accountabilities (55%)

Security Hardening

• Implement and maintain RBAC, managed identities, access controls, network controls, cloud policies, approved image standards, and platform baselines.
• Coordinate and execute vulnerability remediation across cloud services, operating systems, containers, Kubernetes platforms, middleware, and platform components.
• Support patching initiatives, security evidence collection, compliance validation, and platform-control reviews.

Resilience Engineering

• Engineer and improve platform availability, fault tolerance, scalability, capacity, recovery readiness, and overall resilience across Azure and AWS platform services.
• Identify, prioritize, and remediate platform single points of failure, fragile dependencies, capacity constraints, and recovery gaps.
• Plan and execute resilience testing, recovery validation, disaster-recovery exercises, failure scenarios, and remediation activities within assigned platform domains.
• Document resilience assessments, recovery procedures, capacity findings, test evidence, identified risks, and validated recovery outcomes.

Security and resilience enablement

• Support telemetry, logs, traces, alerts, dashboards, and integrations with Dynatrace, Splunk, Azure Monitor, CloudWatch, and ServiceNow.
• Implement automation supporting security controls, recovery validation, observability onboarding, compliance verification, and engineering efficiency.

Secondary Accountabilities (20%)

Observability & Automation

• Act as the designated secondary owner for assigned observability and automation capabilities in accordance with the Platform Capability Ownership Model.
• Provide secondary ownership and engineering support for platform observability capabilities across Dynatrace, Splunk, Azure Monitor, and CloudWatch.
• Support and continuously improve platform dashboards and observability capabilities within the designated secondary-owner scope.
• Implement and maintain telemetry integrations across metrics, logs, distributed traces, cloud-native monitoring services, enterprise observability platforms, and ServiceNow.
• Configure and tune alerts, thresholds, routing, correlation, and escalation logic to reduce noise, improve detection quality, and support timely operational response.
• Develop engineering automation that improves observability onboarding, dashboard and alert consistency, security controls, recovery validation, compliance verification, platform consistency, and operational efficiency.
• Build and maintain operational tooling that enables repeatable diagnostics, telemetry validation, evidence collection, platform validation, remediation, and support workflows.

Supporting Responsibilities (10%)

Infrastructure as Code

• Support Terraform implementation activities.
• Support environment-readiness validation.
• Participate in provisioning reviews when acting as backup coverage.

Kubernetes & Runtime Services

• Provide backup support for AKS, EKS, and runtime services when assigned.

Platform Readiness and Migration Support

• Perform platform-readiness validation for new and changed capabilities within assigned infrastructure and runtime domains, including Terraform implementation, environment consistency, AKS or EKS readiness, CI/CD enablement, and supporting security, resilience, observability, recovery, capacity, and supportability evidence.
• Contribute to KONEK Core migration readiness through Terraform implementation, AWS environment provisioning, observability onboarding, runtime validation, cutover support, and post-migration platform stabilization within assigned scope.
• Contribute to controlled Azure decommissioning after migration through assigned dependency validation, configuration disposition, access removal, resource retirement, inventory updates, and evidence collection while primary owners validate resilience, security, compliance, and retention requirements.

Cross-Cloud Expectations

The engineer is expected to maintain deep practical expertise in one primary cloud platform, Azure or AWS, and working proficiency in the alternate platform. This capability must support Terraform implementation, environment provisioning, migration readiness, troubleshooting, documentation, recovery validation, continuity requirements, structured cross-training, and backup coverage as KONEK Core transitions from Azure to AWS.

AWS is the strategic primary cloud platform for KONEK. Azure capability is required to support migration readiness, platform validation, continuity requirements, operational support during transition, and controlled Azure decommissioning. As migration activities progress, platform engineering focus will increasingly shift toward AWS platform capabilities, controls, resilience, observability, automation, and security engineering.

Execute assigned backup-owner responsibilities for Platform capabilities and periodically perform recovery-validation, maintenance, and readiness activities without reliance on the primary owner.

Participate in structured cross-training, reverse-shadowing, recovery validation, documentation maintenance, and backup execution activities to support the Platform Coverage Model and zero-person-level single-point-of-failure requirements.

Cloud Cost Optimization and Governance

• Support Azure and AWS cost optimization within assigned infrastructure domains through utilization analysis, rightsizing recommendations, scaling-policy improvements, identification of idle or obsolete resources, and implementation of approved cost-effective platform patterns.
• Improve cost visibility and allocation by maintaining tagging compliance, ownership metadata, cost-allocation tags, resource inventories, budgets, alerts, dashboards, and reporting inputs for assigned Azure and AWS capabilities.
• Support the evaluation, implementation, utilization monitoring, and renewal planning of Azure reservations and savings plans and AWS Reservations and Savings Plans in partnership with enterprise cloud-platform and finance teams.
• Support storage-cost optimization through assigned lifecycle-policy updates, retention controls, tiering, snapshot and backup reviews, volume optimization, unused-data cleanup, and evidence collection while primary owners validate resilience and compliance requirements.
• Provide cost-governance and reporting support by investigating material variances, documenting optimization opportunities, tracking approved actions to closure, and collecting realized-savings evidence while primary owners validate security, resilience, performance, and compliance outcomes.

Accountability mix. Security Hardening and Vulnerability Remediation: 30%; Resilience Engineering and Recovery Readiness: 25%; Observability and Automation: 20%; Migration Activities: 5%; and Infrastructure as Code, Environment Provisioning, and Kubernetes.

Backup Support: 10%. Platform incident and problem support represents 10% of total ePort delivered across these capability allocations and is not an additional allocation.

Відгукнутись на вакансію