{"id":664110,"url":"https://alion.io/job/apexanalytix-senior-cloud-engineer","title":"Senior Cloud Engineer","company":{"id":668920,"name":"Apexanalytix","domain":"apexanalytix.com","url":"https://alion.io/company/apexanalytix","size_band":"51-200","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Rippling","truth_index":{"grade":"A","score":89,"open_postings":9,"ghost_share":0,"stale_share":0.222,"repost_share":0,"time_to_fill_p50_days":108,"computed_at":"2026-10-31T05:58:55Z"}},"role":"DevOps","role_family":"DevOps","seniority":"senior","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Noida, India"],"countries":["IN"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":16000,"max_usd":38000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":53},"experience_years_min":8,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Active Directory","optional":false},{"name":"Ansible","optional":false},{"name":"Azure AKS","optional":false},{"name":"Bash","optional":false},{"name":"cert-manager","optional":false},{"name":"Cilium","optional":false},{"name":"DHCP","optional":false},{"name":"DNS","optional":false},{"name":"etcd","optional":false},{"name":"Gateway API","optional":false},{"name":"Git","optional":false},{"name":"GitOps","optional":false},{"name":"Grafana","optional":false},{"name":"Harbor","optional":false},{"name":"Helm","optional":false},{"name":"Keycloak","optional":false},{"name":"kubeadm","optional":false},{"name":"Kubernetes","optional":false},{"name":"KubeVirt","optional":false},{"name":"Kustomize","optional":false},{"name":"KVM","optional":false},{"name":"Linux","optional":false},{"name":"Microsoft Entra ID","optional":false},{"name":"OpenTofu","optional":false},{"name":"PowerShell","optional":false},{"name":"Prometheus","optional":false},{"name":"Python","optional":false},{"name":"Terraform","optional":false},{"name":"Ubuntu","optional":false},{"name":"Velero","optional":false},{"name":"VMWare","optional":false},{"name":"Windows","optional":false},{"name":"Windows Server","optional":false},{"name":"Amazon EKS","optional":true},{"name":"ArgoCD","optional":true},{"name":"AWS","optional":true},{"name":"Azure","optional":true},{"name":"BGP","optional":true},{"name":"DLP","optional":true},{"name":"eBPF","optional":true},{"name":"FedRAMP","optional":true},{"name":"GCP","optional":true},{"name":"HashiCorp Vault","optional":true},{"name":"Loki","optional":true},{"name":"Red Hat","optional":true},{"name":"SOC 2","optional":true},{"name":"Thanos","optional":true}],"status":"live","first_seen_at":"2026-09-01T12:39:26Z","employer_posted_date":"2026-09-01","last_verified_at":"2026-10-31T05:13:12Z","board_verified":true,"closed_at":null,"days_open":59,"trust":{"level":"ok","repost_count":0,"flags":[],"days_open":59},"description":"About Us:\nAt apexanalytix, we’re lifelong innovators! Since the date of our founding nearly four decades ago we’ve been consistently growing, profitable, and delivering the best procure-to-pay solutions to the world. We’re the perfect balance of established company and start-up. You will find a unique home here.\nAnd you’ll recognize the names of our clients. Most of them are on The Global 2000. They trust us to give them the latest in controls, audit and analytics software every day. Industry analysts consistently rank us as a top supplier management solution, and you’ll be helping build that reputation.\nRead more about apexanalytix - https://www.apexanalytix.com/about/\nThe short version\nMost cloud jobs in India are someone else's public cloud. This one is not. The prime focus is Kubernetes on hardware we own: clusters on metal, and tenant clusters those hosts provision. Git is the only path to production. You would own that platform.\nYou will not get an interview on Active Directory and Microsoft 365 alone, and you will not get one on a Kubernetes certificate alone. The person this is written for has already operated both, and wants Kubernetes to be the majority of the work going forward. On-prem Exchange is useful. It is not the job.\nThe stack you will work with. Kubernetes (kubeadm, Cluster API, KubeVirt, hosted control planes, AKS) · Flux, Kustomize, Helm · Harbor · Keycloak · Active Directory, Entra ID, Entra Connect · Microsoft 365, Exchange Online · VMware vSphere/ESXi · Windows Server · Cisco UCS · OpenTofu, Ansible, PowerShell · Prometheus, Grafana · AlmaLinux, Ubuntu · Go, Python, Bash\nWhat you would own\nCluster lifecycle, both layers. Design, build, upgrade and operate Kubernetes across bare-metal (kubeadm), virtualised (KubeVirt with Cluster API and hosted control planes) and managed cloud (AKS). Own the control plane: etcd backup and restore, certificate rotation, upgrades, RBAC and admission. Operate Cluster API so create, upgrade and retire is a repeatable path, not an artisan one. Workload topology (disruption budgets, anti-affinity, requests and limits) and multi-tenancy that actually holds. Diagnose the hard failures and turn them into runbooks.\nGitOps as the operating model. Flux, Kustomize, Helm. Desired state lives in Git, not in someone's shell history. Infrastructure as code with OpenTofu or Terraform and Ansible. Automate toil in PowerShell, Bash, and Python or Go. Written blast-radius and a rollback path before production changes.\nCluster networking and storage, as a platform consumer. Own service exposure on the clusters: Gateway API and HTTPRoute, ingress, kube-vip and CoreDNS. Use NetworkPolicy, StorageClasses, PVCs, snapshots and the CSI drivers the platform is given. Diagnose whether a fault is the application, the CNI, the CSI or the layer beneath, then work it with the network or storage engineer rather than owning those layers. Deep Cilium and Ceph operations sit with those roles.\nActive Directory and hybrid identity. Architect and maintain Active Directory: forest and domain design, Group Policy at scale, replication health, trusts, schema changes, and identity hygiene across multi-domain or multi-site environments. Manage hybrid identity through Entra ID and Entra Connect. Own enterprise DNS and DHCP at scale, including AD-integrated DNS, conditional forwarders, scope design, failover and reservations. Join Linux and Windows hosts into the directory where the platform requires it, and integrate Kubernetes access with the identity you already run. Windows Server lifecycle, provisioning, patching, hardening, performance tuning and decommissioning, is part of this, including Windows worker nodes on the clusters.\nMicrosoft 365 and application mail. Exchange Online, hybrid mail flow, and the Microsoft 365 admin surface. Application email enablement: SMTP relay, OAuth 2.0 for mail, SPF, DKIM and DMARC. On-prem Exchange Server is useful if you have it. It is not required.\nVMware and KubeVirt virtualization. Operate the VMware estate (vSphere/ESXi, vCenter, HA, VM lifecycle) and the boundary with Kubernetes. On the Kubernetes side, KubeVirt is how VM workloads run on the clusters, on KVM. You decide which workload belongs where rather than lifting everything by default.\nPlatform services. Container registry (Harbor or equivalent) and cluster identity (Keycloak or equivalent, federated with Active Directory and Entra ID), or the depth to take both on. Secrets, cert-manager, and image policy as part of how the fleet is run.\nKubernetes-native backup and restore. Own backup and disaster recovery for stateful workloads with Velero, Kopia and etcd snapshots, and prove it by restoring, not by reading a green job status. A backup nobody has restored is not a backup.\nObservability and reliability. Prometheus and Grafana the team actually uses. On-call as a shared rotation, incident command when the platform is the fault, and a root cause analysis afterwards. Capacity planning, and DR you have tested rather than documented.\nThe path from a new server to a production node. Repeatable provisioning, not a manual build: out-of-band management (IPMI, iLO, iDRAC), RAID, SAN/NAS attach, Cisco UCS, firmware, then kubeadm or Cluster API with CNI and CSI validated before the node takes workload. Linux and Windows worker nodes on the same clusters.\nWhat the first year looks like\nMake cluster create, upgrade and retire a GitOps path that someone other than you can run.\nEstablish verified high availability on production: replica counts, host anti-affinity and disruption budgets, applied and checked continuously rather than reconstructed after an outage.\nEstablish provable backup and restore for the Kubernetes platform and its stateful workloads, with independently witnessed evidence. This is a stated company priority, and the platform half of it would be yours.\nBring Active Directory, hybrid identity, Microsoft 365 and the VMware estate under the same operating standard as the Kubernetes platform: documented, monitored, and not a single point of knowledge.\nRemove the single points of knowledge, so no part of the platform depends on one person being reachable.\nWhat we need you to have done\nThree hard requirements. Miss any one and this is not the right role.\n1. Production Kubernetes you have operated, including cluster lifecycle. Not a single managed cluster you clicked in a console, and not a certificate you collected to know it. Walk us through a cluster you built or upgraded, a control-plane failure you diagnosed, and how desired state got from Git onto the nodes.\n2. Certified Kubernetes Administrator (CKA), or equivalent depth you can demonstrate live. The certificate is the floor. We will still ask you to debug a real failure. CKS or CKAD is a plus. Neither substitutes for (1).\n3. Production Active Directory and Microsoft 365 you have operated. Multi-site or multi-domain AD, Entra Connect, Exchange Online and hybrid mail flow. Not an account you were given. On-prem Exchange is not required.\nKubernetes, the majority of the role\n8+ years in infrastructure engineering. Production Kubernetes is a substantial part of recent work, not a lab, a side project or a certification year. We will not insist on five full years of fleet-scale Kubernetes if the depth is real and current, because this hire also has to have run Windows identity and Microsoft 365.\nControl-plane depth: etcd operations, cluster upgrades, RBAC and admission, scheduling, and failure diagnosis that is not restart-and-hope.\nGitOps in production, Flux or ArgoCD with Kustomize and Helm. Git is the only path to production.\nCluster API and KubeVirt, or the equivalent: you have provisioned Kubernetes clusters as virtual machines on a management plane, not only consumed AKS or EKS. KVM underneath is expected.\nWorking knowledge of Kubernetes networking and storage as a cluster operator: Services, NetworkPolicy, Ingress or Gateway API, PVCs and StorageClasses. Deep Cilium and Ceph operations sit with the network and storage roles.\nLinux fundamentals on RHEL/AlmaLinux or Ubuntu: systemd, kernel, the storage and network stacks, performance debugging.\nRestores you have personally performed for clusters or etcd (Velero, Kopia or equivalent). Not backup jobs you monitored.\nPrometheus and Grafana in production. Thanos or Loki is a plus.\nContainer registry and cluster identity (Harbor and Keycloak or equivalent), or the depth to take both on.\nWindows identity and Microsoft 365, you arrive with this\nHands-on Active Directory: multi-domain or multi-site, Group Policy at scale, replication, trusts, identity hygiene. Entra ID and Entra Connect. Enterprise DNS and DHCP, including AD-integrated DNS and DHCP failover.\nMicrosoft 365 in production: Exchange Online, hybrid mail flow, and the M365 admin surface. Azure administration fundamentals.\nApplication mail flow: SMTP relay, OAuth 2.0 for mail, SPF / DKIM / DMARC.\nWindows Server in production, including Windows worker nodes in Kubernetes, not console-only.\nPowerShell as a working tool, not a line on a CV. OpenTofu or Terraform, Ansible and Bash as well, plus Python or Go.\nHardware and virtualization\nPhysical server work: IPMI, iLO, iDRAC, RAID, SAN/NAS attach, Cisco UCS. Automate it rather than repeat it.\nVMware vSphere/ESXi in production: hosts, vCenter, clusters, VM lifecycle, and how that estate meets Kubernetes.\nBachelor's degree in Computer Science, Information Technology, or equivalent practical experience.\nClear writing. An ownership mindset. Troubleshooting that proves where the fault is, across identity, mail flow, networking and storage.\nNice to have\nCilium in production: eBPF datapath, BGP control plane, LB-IPAM, ClusterMesh, network policy and Hubble. The Senior Network Engineer owns this layer. It is useful here, not required.\nCeph and CSI operations: Rook or cephadm, OSD and CRUSH, CephFS and RBD, snapshots and storage performance troubleshooting. The Senior Storage Engineer owns this layer. It is useful here, not required.\nDatacenter networking: VLANs, LACP, BGP, VXLAN, MTU and jumbo frames, enough to work fluently alongside the network team.\nExperience building and operating bare-metal Kubernetes, not managed cloud only.\nAzure experience (AKS and hybrid connectivity). AWS or GCP also useful.\nOn-prem Exchange Server 2016/2019/SE: DAGs, hybrid configurations, CU/SU patching and migrations. Useful. Not required. Office 365 is the mail requirement.\neDiscovery (standard and/or premium) and Microsoft Purview: data classification, DLP, retention and audit workflows. Useful. Not required. Microsoft 365 administration is the mail and identity requirement.\nConditional access, Intune, and broader Entra ID security tooling.\nThanos, Loki, Tempo, Flatcar Container Linux, OpenBao.\nExperience in a FedRAMP, SOC 2, or comparable regulated environment.\nRed Hat (RHCSA/RHCE), Ceph, Isovalent/Cilium, HashiCorp Vault, or Azure (AZ-104 / AZ-305) certification.\nContributions to open-source infrastructure projects.\nBoundaries\nBackup responsibility is split across three roles. This is the proposed division.\nOwner\nOwns\nSenior Cloud Engineer\n(this role)\nKubernetes-native stateful backup as part of the platform: Velero, Kopia, etcd snapshots, CSI snapshot plumbing.\nSenior Storage Engineer\nThe storage and backup platform beneath it: enterprise arrays, Commvault, Ceph capacity, and restore evidence for non-database systems.\nManager, Data Platform\nDatabase backup, point-in-time recovery and restore, and the evidence standard for data recoverability.\nHow the team works\nYou would join the IT Infrastructure team and work directly with network, storage, security and the application platform teams.\nOn-call is a shared rotation, not a permanent state. Major incidents escalate to the whole team, and we would rather fix the cause than staff the symptom.\nWe expect ownership rather than ticket-taking. If you find something broken outside your area, we would rather you said so than routed it.\nBased in...","description_format":"text","description_chars":13360,"description_truncated":true,"requirements":{"experience_years_min":8,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":["Wellness"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":true,"industries":["Information Technology","Transportation & Logistics","Fraud Detection","Supply Chain"],"lifecycle":[{"event":"open","at":"2026-09-10T21:49:34Z"}],"visa":[],"liveness":{"score":80,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.888,"p_room":0.9,"age_days":59,"expected_fill_days":108,"reasons":["conf:0","velocity","win:mid"],"computed_at":"2026-10-31T05:58:55Z"},"pay":null,"html_url":"https://alion.io/job/apexanalytix-senior-cloud-engineer","json_url":"https://alion.io/job/apexanalytix-senior-cloud-engineer.json","meta":{"generated_at":"2026-10-31T07:43:06Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":11467,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-01T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":668920},"rest":"https://alion.io/mcp/rest/get_company?id=668920"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fapexanalytix-senior-cloud-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fapexanalytix-senior-cloud-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fapexanalytix-senior-cloud-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/apexanalytix-senior-cloud-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fapexanalytix-senior-cloud-engineer"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":664110}},{"tool":"search_jobs","arguments":{"company":"apexanalytix.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":664110},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}