DevOps / SRE Engineer

Intempt runs 36+ microservices on AWS EKS (Kubernetes 1.25) processing 350M+ events/month. Aurora PostgreSQL 13.8, MSK Kafka 3.3.1, ClickHouse, Apache Flink, HashiCorp Vault, and Redis are all managed through Terraform with SOPS-encrypted secrets, deployed via GitHub Actions CI/CD with OIDC auth.

The infrastructure works. We need someone to own it.

You'll manage the full lifecycle: EKS clusters with spot instances across node groups, Aurora provisioned instances with logical replication, MSK brokers with TLS and auto-scaling storage, Vault HA with KMS auto-unseal, cert-manager for Route53 DNS validation, ALB ingress controllers, cluster autoscaler, EFS, Noobaa object storage, and S3+CloudFront static site delivery. Every service has its own ECR repo with immutable tags, scan-on-push, and a dedicated GitHub Actions deployer role scoped to exactly the permissions it needs.

What you'll own

• EKS cluster operations — node group scaling, spot instance management, Fargate profiles, security groups, OIDC provider config
• Terraform IaC across all environments (staging/QA/production) with S3 state backend and SOPS+KMS secret management
• Database reliability — Aurora PostgreSQL 13.8 (provisioned, 2 instances, encrypted, logical replication), ElastiCache Redis, ClickHouse on Altinity
• Streaming infrastructure — MSK Kafka 3.3.1 (TLS, CloudWatch logs, Prometheus JMX/Node exporters, auto-scaling storage) and Flink Kubernetes Operator 1.4.0
• CI/CD pipeline — GitHub Actions with OIDC auth, 20+ per-service deployer roles mapping git repos to ECR repos, plan/apply workflow with manual production gates
• Secrets and service identity — HashiCorp Vault HA on EKS with PostgreSQL backend, KMS auto-unseal, Transit engine, AppRole auth
• Observability — DataDog agents, Prometheus exporters, CloudWatch, incident response and runbooks
• Backup and DR — AWS Backup (daily, 30-day retention) covering S3 and EFS, RDS automated backups, point-in-time recovery

You are

• 3+ years running production Kubernetes on AWS — not just deploying to it, actually operating clusters at scale
• Deep Terraform experience — you've managed multi-environment IaC with remote state, modules, and encrypted secrets
• Comfortable with managed Kafka (MSK or Confluent), stream processing (Flink/Spark), and the failure modes of distributed messaging
• Familiar with HashiCorp Vault operations — unsealing, secret rotation, Transit engine, AppRole patterns
• Someone who has set up and maintained CI/CD pipelines with least-privilege IAM roles and OIDC federation
• Strong in networking fundamentals — VPCs, security groups, NLBs, ALBs, DNS (Route53), TLS certificates (ACM/cert-manager)
• The person who automates themselves out of toil and writes the runbook before the pager goes off

Stack you'll live in

AWS (EKS, Aurora, MSK, ElastiCache, S3, CloudFront, Route53, ACM, EFS) · Kubernetes 1.25 · Terraform · GitHub Actions · HashiCorp Vault · Apache Flink · ClickHouse (Altinity Cloud) · Loki · Helm · SOPS + KMS · Docker / ECR · Prometheus

Not a fit if

• You've only used managed Kubernetes through a UI — we need someone who reads the Terraform and knows what every resource does
• You think infrastructure-as-code means a CloudFormation template someone else wrote
• You can't debug a pod that won't schedule without googling every error message