Senior Infrastructure Engineer

The core responsibilities for the job include the following:

GCP Architecture and Operations:

• Design, build, and operate production-grade environments on GCP (projects, folders, and org policies).
• Standardise Cloud Run service patterns (revisions, concurrency, autoscaling, min/max instances, and VPC access).
• Implement Cloud Build pipelines (triggers, build steps, artefacts, promotions), and manage secrets (Secret Manager).

Networking (Deep):

• Plan and manage VPCs, subnets, firewall rules, routes, shared VPCs, and Private Google Access.
• Configure Cloud NAT, Cloud Router, VPC Peering/Network Connectivity Centre, and Private Service Connect.
• DNS design and operations with Cloud DNS (zones, split-horizon, forwarding, policy, and health checks).

Load Balancing and Proxies:

• Architect and operate external/internal HTTP(S), TCP/UDP (network), and proxy load balancers.
• URL maps, host/path routing, backend services, NEG types (serverless NEGs for Cloud Run), health checks, and session affinity.
• TLS termination/offload, Google-managed certificates, and mTLS where applicable.

Security and Compliance:

• Network controls (hierarchical firewall policies, perimeter designs, and VPC-SC where needed).
• Ensure infrastructure designs and configurations support PCI DSS controls related to:
• Network segmentation between cardholder data environments (CDE) and non-CDE systems.
• Firewall and VPC rules: restrict inbound/outbound traffic, and maintain a deny-by-default posture.
• Encryption standards: enforce TLS 1.2+ for data in transit and AES-256 or Google-managed CMEK for data at rest.
• Access management: implement least-privilege IAM, service-account separation, and MFA on administrative accounts.
• Change management: follow approved processes for infrastructure and DNS/network modifications.
• Vulnerability management: ensure patching cadence and vulnerability scans across compute and containerised workloads.
• Audit logging and monitoring: maintain Cloud Audit Logs, VPC Flow Logs, and GCS access logs with immutable retention and alerting.

Reliability, DR, and HA:

• Multi-zone/region strategies and RTO/RPO definitions and testing.
• Backups and restore runbooks (Cloud SQL, GCS, Firestore), traffic failover patterns, and dependency maps.

Observability and Cost Management:

• Logging/metrics/tracing with Cloud Monitoring and Cloud Logging; SLO/SLA/SI targets.
• Cost visibility: labels/tagging standards, budgets and alerts, committed use discounts, and rightsizing.

Platform and Containers:

• Container build hardening (distroless/base image strategy), SBOMs, and vulnerability scanning.
• Runtime policies, connection management (DB proxies, private endpoints), and performance tuning of Cloud Run (cold start, CPU always on).

Enablement and Collaboration:

• Write concise runbooks, diagrams, and architecture docs.
• Mentor junior engineers; provide a client-first support mindset and pragmatic guidance.

Requirements:

• Strong IAM hygiene (least privilege, service accounts, workload identity federation).
• 4-6 years in cloud infrastructure/SRE with at least 3 years on GCP.
• Hands-on with Cloud Run, Cloud Build, Cloud DNS, Cloud NAT/Router, LBs, Secret Manager, and KMS.
• Strong networking fundamentals (TCP/IP, BGP basics, CIDR, NAT, proxies, DNS).
• Proven track record in cost management, monitoring/alerting, and production incident handling.
• Solid grasp of DR/HA, RTO/RPO, backup/restore, and traffic failover.
• SSL/TLS: cert lifecycle, cyphers, HSTS basics, and Google-managed certs on LBs.