DevOps / SRE Engineer

Intempt runs 36+ microservices on AWS EKS (Kubernetes 1.25) processing 350M+ events/month. Aurora PostgreSQL 13.8, MSK Kafka 3.3.1, ClickHouse, Apache Flink, HashiCorp Vault, and Redis are all managed through Terraform with SOPS-encrypted secrets, deployed via GitHub Actions CI/CD with OIDC auth.
The infrastructure works. We need someone to own it.
You'll manage the full lifecycle: EKS clusters with spot instances across node groups, Aurora provisioned instances with logical replication, MSK brokers with TLS and auto-scaling storage, Vault HA with KMS auto-unseal, cert-manager for Route53 DNS validation, ALB ingress controllers, cluster autoscaler, EFS, Noobaa object storage, and S3+CloudFront static site delivery. Every service has its own ECR repo with immutable tags, scan-on-push, and a dedicated GitHub Actions deployer role scoped to exactly the permissions it needs.
What you'll own
EKS cluster operations — node group scaling, spot instance management, Fargate profiles, security groups, OIDC provider config
Terraform IaC across all environments (staging/QA/production) with S3 state backend and SOPS+KMS secret management
Database reliability — Aurora PostgreSQL 13.8 (provisioned, 2 instances, encrypted, logical replication), ElastiCache Redis, ClickHouse on Altinity
Streaming infrastructure — MSK Kafka 3.3.1 (TLS, CloudWatch logs, Prometheus JMX/Node exporters, auto-scaling storage) and Flink Kubernetes Operator 1.4.0
CI/CD pipeline — GitHub Actions with OIDC auth, 20+ per-service deployer roles mapping git repos to ECR repos, plan/apply workflow with manual production gates
Secrets and service identity — HashiCorp Vault HA on EKS with PostgreSQL backend, KMS auto-unseal, Transit engine, AppRole auth
Observability — DataDog agents, Prometheus exporters, CloudWatch, incident response and runbooks
Backup and DR — AWS Backup (daily, 30-day retention) covering S3 and EFS, RDS automated backups, point-in-time recovery
You are
3+ years running production Kubernetes on AWS — not just deploying to it, actually operating clusters at scale
Deep Terraform experience — you've managed multi-environment IaC with remote state, modules, and encrypted secrets
Comfortable with managed Kafka (MSK or Confluent), stream processing (Flink/Spark), and the failure modes of distributed messaging
Familiar with HashiCorp Vault operations — unsealing, secret rotation, Transit engine, AppRole patterns
Someone who has set up and maintained CI/CD pipelines with least-privilege IAM roles and OIDC federation
Strong in networking fundamentals — VPCs, security groups, NLBs, ALBs, DNS (Route53), TLS certificates (ACM/cert-manager)
The person who automates themselves out of toil and writes the runbook before the pager goes off
Stack you'll live in
AWS (EKS, Aurora, MSK, ElastiCache, S3, CloudFront, Route53, ACM, EFS) · Kubernetes 1.25 · Terraform · GitHub Actions · HashiCorp Vault · Apache Flink · ClickHouse (Altinity Cloud) · Loki · Helm · SOPS + KMS · Docker / ECR · Prometheus
Not a fit if
You've only used managed Kubernetes through a UI — we need someone who reads the Terraform and knows what every resource does
You think infrastructure-as-code means a CloudFormation template someone else wrote
You can't debug a pod that won't schedule without googling every error message