Senior DevOps Engineer (Platform & DevSecOps)

ABOUT THE ROLE

The Senior DevOps Engineer designs, automates, and maintains high-availability, fault-tolerant, and secure infrastructure powering digital financial products (e.g., nano-finance, consumer finance, e-payments, digital insurance brokerage).

Operating within an FRA-regulated environment, this role bridges core software development and the CISO’s governance framework. The engineer is responsible for embedding DevSecOps pipelines, automated compliance controls, immutable audit logging, and Disaster Recovery (DR) automation into every layer of the cloud and on-premise infrastructure.

KEY RESPONSIBILITIES

1. DevSecOps & CI/CD Automation

• Design, build, and maintain automated CI/CD pipelines (e.g., GitLab CI, GitHub Actions, ArgoCD) ensuring zero-downtime blue/green or canary deployments.
• Enforce "shift-left" security controls directly into deployment workflows: integrate automated SAST (Static Application Security Testing), DAST, software composition analysis (SCA), and container image vulnerability scanners (e.g., SonarQube, Snyk, Trivy).
• Enforce binary authorization and artifact signing, ensuring only cryptographically verified images are deployed to production clusters.

2. Infrastructure as Code (IaC) & Cloud Architecture

• Architect and manage scalable cloud infrastructure (AWS / Microsoft Azure / local data centers) using Terraform or Terragrunt, maintaining 100% declarative infrastructure.
• Ensure infrastructure architecture strictly satisfies Egyptian data residency and hosting regulations as outlined under FRA Decree No. 139/2023 and Decree No. 141/2023 (Fintech Outsourcing Register).
• Implement network zoning, Micro-segmentation, Virtual Private Clouds (VPCs), and Zero-Trust access rules to isolate microservices, payment gateways, and core non-banking ledger systems.

3. Container Orchestration & Platform Engineering

• Manage production-grade Kubernetes clusters (EKS, AKS, or bare metal) focusing on multi-tenancy, resource optimization, autoscaling (HPA/KEDA), and high availability.
• Implement Kubernetes security standards: Network Policies, Role-Based Access Control (RBAC), Pod Security Standards, and runtime threat detection (e.g., Falco).
• Provide self-service internal developer platforms (IDPs) that allow product developers to provision test environments and deploy services safely.

4. High Availability, BCM & Disaster Recovery (DR)

• Build and automate Disaster Recovery failover protocols to satisfy FRA business continuity thresholds for Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO).
• Automate continuous database backups, snapshot replication, and cross-region/cross-zone synchronization.
• Lead semi-annual scheduled DR failover drills alongside the CISO and Risk teams, proving operational resilience during simulated complete data center outages.

5. Regulatory Logging, Telemetry & Observability

• Deploy enterprise-wide observability stacks (Prometheus, Grafana, OpenTelemetry, ELK/OpenSearch, Datadog).
• Construct tamper-evident, centralized audit log pipelines that stream system, database, and administrative actions directly to the SOC/SIEM, enforcing the FRA’s mandatory five-year log retention and immutability rules.
• Configure real-time alerts, synthetic monitoring, and SLO/SLI tracking across mission-critical endpoints (digital onboarding, eKYC, and transaction routing).

6. Secrets, Cryptography & eKYC Infrastructure Support

• Oversee enterprise secret management using tools like HashiCorp Vault, enforcing short-lived credentials, automated secret rotation, and dynamic database credentials.
• Support engineering pipelines that interface with Cloud HSMs and digital signature modules used to seal digital contracts under FRA Decree No. 140 of 2023.

Technical Stack

• Cloud & Virtualization: AWS, Microsoft Azure, VMware / OpenStack.
• Containers & Orchestration: Docker, Kubernetes (EKS/AKS), Helm, Istio / Linkerd.
• Infrastructure as Code & Config: Terraform, Terragrunt, Ansible.
• CI/CD & GitOps: GitLab CI, GitHub Actions, ArgoCD, FluxCD.
• Security & Compliance: HashiCorp Vault, Trivy, Snyk, SonarQube, Wazuh, Falco.
• Observability: Prometheus, Grafana, Loki, ELK/OpenSearch, Datadog.
• Scripting & Languages: Python, Bash, Go.

REQUIREMENTS

Required Qualifications & Experience

1. Education

- Bachelor’s degree in computer science, Software Engineering, Computer Information Systems, or a related field.

2. Experience

- 5-8 years of overall IT/Software Engineering experience, with at least 4 years dedicated to DevOps, Site Reliability Engineering (SRE), or Platform Engineering in a FinTech, Digital Banking, or highly regulated transactional environment.

3. Regulatory & Security Understanding

- Proven track record working under strict InfoSec oversight (ISO 27001, PCI-DSS, or central bank/financial regulator standards); familiarity with Egypt's data privacy (PDPL 151/2020) and FRA IT requirements.

4. Certifications (Preferred)

- At least one certified tier: Certified Kubernetes Administrator (CKA), AWS Certified DevOps Engineer - Professional, Microsoft Certified: DevOps Engineer Expert, or HashiCorp Certified: Terraform Associate.

5. Hands-On Depth

- Strong troubleshooting acumen across Linux kernel internals, TCP/IP networking, DNS, TLS/SSL termination, and distributed systems performance tuning.

Core Competencies

• Security-First Mentality: Considers security and auditability as non-negotiable architectural foundations rather than an afterthought.
• Automation Advocate: Intolerance for manual, error-prone operational tasks ("toil"); proactive in writing clean automation scripts and IaC modules.
• Incident Ownership: Proven ability to troubleshoot complex production outages under pressure, conducting blameless post-mortems and driving systemic fixes.
• Communication: Ability to collaborate seamlessly with software engineers, product managers, quality assurance, and external regulatory auditors.