DevOps Engineer - Azure

We are seeking an experienced cloud and DevOps Engineer to join our Information Technology group as a platform/DevOps engineer supporting our Azure-based microservices platform. This role designs, implements, and maintains our GitOps-driven cloud infrastructure, CI/CD pipelines, and Kubernetes-based deployments. The ideal candidate has hands-on experience with Flux, Helm, Azure Kubernetes Service (AKS), GitHub Actions, and containerized workloads on Linux. They must communicate effectively with team members across multiple time zones and analyze complex problems to deliver effective solutions in a cloud-native context.

Responsibilities:

• Collaborate with software developers and IT staff to oversee code releases and Kubernetes deployments across multiple environments (test, conversion, production-grade clusters).
• Build and maintain GitHub Actions CI/CD workflows, including reusable workflows shared across the platform's service repositories.
• Author and maintain Helm charts and Flux Helm Release/Kustomization manifests that drive GitOps deployments to AKS.
• Manage Azure infrastructure as code (Bicep) for AKS clusters, networking, Azure Container Registry (ACR), and Azure Key Vault.
• Operate secrets management using Azure Key Vault with the Secrets Store CSI Driver and workload/managed identity (federated, keyless auth).
• Build and harden Docker images (multi-stage builds, distroless/Debian/Alpine bases, non-root users, gRPC health probes) and publish to ACR.
• Maintain Makefile-driven build, test, lint, and deploy targets that provide consistent semantics across Go and Java service repositories.
• Configure and tune observability with OpenTelemetry collectors and Prometheus; support log, trace, and metric pipelines for platform services.
• Enforce platform governance: branch protection, conventional commits, secrets scanning (Gitleaks), SBOM/image scanning, and reusable workflow standards.
• Monitor and optimize cluster performance, scalability, cost, and security across multiple AKS environments.
• Troubleshoot incidents across the stack, from Flux reconciliation, ingress (Traefik), and pod networking down to JVM/GO runtime behavior.

Requirements:

• 4+ years of applicable work and/or technical experience.
• Hands-on expertise with Azure cloud services, particularly AKS, Azure Container Registry, Azure Key Vault, and Azure Entra ID workload identity / federated credentials.
• Strong experience with GitOps using Flux v2 (HelmRelease, Kustomization, HelmRepository, and multi-environment value overlays).
• Solid experience authoring and operating Helm v3 charts (templates, value stratification per environment, and OCI chart repositories).
• Familiarity with secrets-scanning workflows (gitleaks) and able to safely remove sensitive content from history when required.
• Able to coach others on Git best practices and review PRs not just for code quality but for commit structure and message clarity.
• Infrastructure-as-Code experience with Bicep (or Terraform/ARM with willingness to work in Bicep).
• Familiarity with Go (1.26+) and/or Java 21 / Gradle build systems; able to read service code, debug build failures, and reason about runtime behavior.
• Experience with gRPC/Protobuf tooling (buf, protoc) is a plus.
• Experience with observability stacks (OpenTelemetry, Prometheus, Grafana) is a plus.
• Familiarity with Kafka, Redis, Elasticsearch, or MS SQL Server in containerized environments is a plus.
• Azure certifications (e. g., AZ-104, AZ-400, Azure Solutions Architect) are a plus.
• Excellent analytical and problem-solving skills, with the ability to debug from YAML manifest down to application runtime.
• Outstanding organizational and time management skills.
• Excellent collaboration skills both within the team and across other teams, including comfort working with onshore counterparts across time zones.
• Must be self-motivated, able to work and learn independently, coachable, and committed to continuous learning.
• Proven experience operating containerized workloads on Kubernetes (deployments, services, ingress, configmaps/secrets, probes, resource limits).
• Hands-on experience building CI/CD pipelines with GitHub Actions, including reusable workflows, self-hosted runners, OIDC federation to Azure, and concurrency/branch-protection patterns.
• Comfortable writing and maintaining Makefiles as the primary build/test/lint orchestration layer.

Strong Dockerfile authoring skills are required. Engineers are expected to write production-quality Dockerfiles, not just consume existing ones. Specifically:

• Authoring multi-stage builds that produce minimal, hardened images (distroless, Debian Slim, or Alpine bases as appropriate).
• Disciplined layer ordering and caching to keep builds fast and reproducible; correct use of. dockerignore.
• Image hardening: running as a non-root user, dropping capabilities, avoiding shells where possible, pinning base images by digest, and configuring proper HEALTHCHECK / gRPC health probes.
• Safe handling of secrets and building context using --secret, BuildKit, and build args (never baking secrets into layers).
• Comfortable debugging container builds and runtime issues using docker build --progress, docker run, docker exec, image inspection, and log review.

Strong Ubuntu / Linux CLI skills are required. Day-to-day work happens in headless Linux environments (Ubuntu runners, container shells, AKS nodes), and engineers must be fully comfortable on the command line without graphical tools. Specifically:

• Fluent with the core toolchain: bash, apt, systemd/systemctl/journalctl, ssh, scp, rsync, tar, curl, wget, and openssl.
• Strong text-processing skills with grep, sed, awk, cut, sort, uniq, xargs, find, jq, and yq.
• Comfortable diagnosing system and network issues with ps, htop / btop, lsof, ss, netstat, dig, nslookup, nc, tcpdump, traceroute, and iptables basics.
• Solid understanding of Linux file permissions, ownership, environment variables, process management, signals, exit codes, and shell scripting (including writing reusable, defensively written Bash scripts with set -euo pipefail).
• Able to write and maintain shell scripts that are safe to run in CI pipelines and Makefile targets.

Strong Git skills are required. The team enforces a strict commit and branching specification, and engineers are expected to maintain a clean, linear, and reviewable history. Specifically:

• Fluency with advanced Git operations: interactive rebase (git rebase -i) to squash, reorder, reword, and fix up commits; cherry-picking; git bisect; reflog-driven recovery; and resolving non-trivial merge/rebase conflicts.
• Disciplined commit hygiene: small, atomic, logically scoped commits with well-written messages that follow the Conventional Commits specification (enforced via commitlint).
• Comfortable working under branch protection rules (required status checks, required reviews, linear history, and signed commits) and able to keep feature branches up to date via rebase rather than merge commits.