DevOps and Platform Engineer

SUMMARY:
Role overview:
The DevOps and Platform Engineer implement and maintain the hosting platform: the virtual machines and services that run the company's applications in Private Hosted Environments, and public cloud services where the business needs them. The role keeps that environment patched, secure, monitored, recoverable and well documented, and builds and maintains the automation (pipelines and infrastructure as code) that gets applications onto it reliably and repeatably.
The role reports to the Platform and Engineering Manager, who sets the hosting standards and assists where needed. The engineer implements and maintains the environment to those standards and is the main hands-on owner of the platform day to day.
 
Key duties
Hosting infrastructure:

• Implement, configure, operate, and maintain the hosting virtual machines and services in Private Hosted Environments, to the standards set by the Platform and Engineering Manager.
• Implement and maintain public cloud services on AWS and Azure where the business needs them, to the same standards.
• Carry out routine maintenance, including patching, upgrades, certificate and credential renewals, and lifecycle management.
• Provision and decommission development, test, and production environments in a consistent, repeatable way.
• Maintain an accurate inventory of hosted systems, environments, and their dependencies.

• Build and maintain the CI/CD pipelines used by the development team.
• Define infrastructure as code so environments can be rebuilt from source control rather than by hand.
• Automate repetitive operational work and reduce manual steps in deployment and maintenance.
• Support developers in deploying and running their applications correctly in each environment.

• Apply hardening baselines, network segmentation, and firewall and access rules across hosted environments.
• Manage access to hosting environments on a least-privilege basis, review it regularly and remove it promptly when no longer needed.
• Manage secrets, keys and certificates so that no credentials sit in code or repositories.
• Run dependency, container image and configuration scanning in the pipelines, and act on the results with the Platform and Engineering Manager.
• Remediate hosting-related security and risk findings assigned by the Platform and Engineering Manager within agreed timelines and provide evidence of the fix for independent verification.

• Implement and operate backups for hosted systems, aligned to the agreed RPO/RTO and system classification.
• Test restores on a regular schedule and records the results.
• Maintain recovery runbooks and contribute to disaster recovery and business continuity planning.

• Implement monitoring, alerting and log collection for hosted systems, and keep alerts actionable.
• Respond to hosting incidents, restore service, and document the root cause and follow-up actions.
• Take part in out-of-hours support for hosted systems.

• Raise hosting changes through the IT Operations change process and implement only approved changes.
• Record what was changed, when and why, so changes can be traced and reversed.

• Right-size and tag resources, and flag unused or underused resources.
• Provide the Platform and Engineering Manager with consumption data so spend can be tracked and motivated.

• Maintain runbooks, architecture diagrams, and procedures so another team member can operate, restore and rebuild the environment in the engineer's absence.
• Work with the Platform and Engineering Manager and the senior developers so that at least one other person can perform critical tasks such as restoring from backup, rotating credentials, and deploying to production.

• 5+ years in infrastructure, DevOps, or hosting roles, running production systems.
• Hands-on experience implementing and running virtual machines and services in privately hosted environments, including virtualisation platforms.
• Working experience with AWS and Azure services, enough to implement and maintain them where needed.
• Strong Linux server administration.
• Containerisation experience with Docker and an orchestrator such as Docker Swarm or Kubernetes, including reverse proxies and load balancing.
• Infrastructure as code experience (for example Terraform, Bicep, CloudFormation or Ansible) and CI/CD pipeline experience.
• Solid networking knowledge, including DNS, TLS, firewalls, VPNs, and network segmentation.
• Practical experience with backup, restore and disaster recovery, including having tested restores.
• Experience with monitoring, logging, and alerting tools.
• Understanding of identity and access management, including least privilege, role-based access, SSO and OAuth.
• Scripting ability in Bash, PowerShell, or Python.
• Clear written documentation, and the discipline to work to a standard set by someone else and show evidence of compliance.
• Willingness to take part in out-of-hours support.

• AWS or Azure associate-level certifications.
• Understanding of NIST and CIS controls and CIS benchmark hardening.
• Familiarity with POPIA.

POSITION INFO:
Role overview: The DevOps and Platform Engineer implement and maintain the hosting platform: the virtual machines and services that run the company's applications in Private Hosted Environments, and public cloud services where the business needs them. The role keeps that environment patched, secure, monitored, recoverable and well documented, and builds and maintains the automation (pipelines and infrastructure as code) that gets applications onto it reliably and repeatably. The role reports to the Platform and Engineering Manager, who sets the hosting standards and assists where needed. The engineer implements and maintains the environment to those standards and is the main hands-on owner of the platform day to day. Key duties Hosting infrastructure: Implement, configure, operate, and maintain the hosting virtual machines and services in Private Hosted Environments, to the standards set by the Platform and Engineering Manager. Implement and maintain public cloud services on AWS and Azure where the business needs them, to the same standards. Carry out routine maintenance, including patching, upgrades, certificate and credential renewals, and lifecycle management. Provision and decommission development, test, and production environments in a consistent, repeatable way. Maintain an accurate inventory of hosted systems, environments, and their dependencies. Automation and delivery pipelines: Build and maintain the CI\/CD pipelines used by the development team. Define infrastructure as code so environments can be rebuilt from source control rather than by hand. Automate repetitive operational work and reduce manual steps in deployment and maintenance. Support developers in deploying and running their applications correctly in each environment. Security and hardening: Apply hardening baselines, network segmentation, and firewall and access rules across hosted environments. Manage access to hosting environments on a least-privilege basis, review it regularly and remove it promptly when no longer needed. Manage secrets, keys and certificates so that no credentials sit in code or repositories. Run dependency, container image and configuration scanning in the pipelines, and act on the results with the Platform and Engineering Manager. Remediate hosting-related security and risk findings assigned by the Platform and Engineering Manager within agreed timelines and provide evidence of the fix for independent verification. Backup, recovery and resilience: Implement and operate backups for hosted systems, aligned to the agreed RPO\/RTO and system classification. Test restores on a regular schedule and records the results. Maintain recovery runbooks and contribute to disaster recovery and business continuity planning. Monitoring and incident response: Implement monitoring, alerting and log collection for hosted systems, and keep alerts actionable. Respond to hosting incidents, restore service, and document the root cause and follow-up actions. Take part in out-of-hours support for hosted systems. Change control: Raise hosting changes through the IT Operations change process and implement only approved changes. Record what was changed, when and why, so changes can be traced and reversed. Cost awareness: Right-size and tag resources, and flag unused or underused resources. Provide the Platform and Engineering Manager with consumption data so spend can be tracked and motivated. Documentation and knowledge sharing: Maintain runbooks, architecture diagrams, and procedures so another team member can operate, restore and rebuild the environment in the engineer's absence. Work with the Platform and Engineering Manager and the senior developers so that at least one other person can perform critical tasks such as restoring from backup, rotating credentials, and deploying to production. Requirements: 5+ years in infrastructure, DevOps, or hosting roles, running production systems. Hands-on experience implementing and running virtual machines and services in privately hosted environments, including virtualisation platforms. Working experience with AWS and Azure services, enough to implement and maintain them where needed. Strong Linux server administration. Containerisation experience with Docker and an orchestrator such as Docker Swarm or Kubernetes, including reverse proxies and load balancing. Infrastructure as code experience (for example Terraform, Bicep, CloudFormation or Ansible) and CI\/CD pipeline experience. Solid networking knowledge, including DNS, TLS, firewalls, VPNs, and network segmentation. Practical experience with backup, restore and disaster recovery, including having tested restores. Experience with monitoring, logging, and alerting tools. Understanding of identity and access management, including least privilege, role-based access, SSO and OAuth. Scripting ability in Bash, PowerShell, or Python. Clear written documentation, and the discipline to work to a standard set by someone else and show evidence of compliance. Willingness to take part in out-of-hours support. Advantageous: AWS or Azure associate-level certifications. Understanding of NIST and CIS controls and CIS benchmark hardening. Familiarity with POPIA.