Principal DevOps Platform Engineer - AWS

Overview

Own and run TechGrove's multi-tenant AWS and Kubernetes platform end to end, set up the missing production capabilities, and lead the DiVa and Otto infrastructure agents as a principal engineer.

What you'll do

• Run the AWS estate: an AWS Organization with shared Networking, Monitoring and Shared Services accounts, plus customer workload accounts (EKS, ECR, RDS, MSK, Route 53).
• Own the deploy path end to end: GitLab CI from one standard template, image build and scan, a GitOps repo, then ArgoCD on EKS.
• Take new services to QA and then to production, including flow6-mt, flow-dynamic-ui, the auth service and Keycloak.
• Make flow6 safe to run as several pods behind one service: per-tenant Quartz schedulers, database locking, cache invalidation across pods, and health and readiness probes.
• Set up production secrets with External Secrets Operator, SSM Parameter Store and pod-level IAM roles (IRSA / Pod Identity) in place of hand-made Kubernetes Secrets.
• Set up identity: Keycloak for staff, the existing auth service for customers, and service accounts for system-to-system calls.
• Set up observability across accounts with Grafana, Prometheus and Loki, with alarms that are tuned rather than noisy.
• Set up the data platform: Apache Doris, CDC pipelines (Postgres logical replication, Oracle LogMiner) and Kafka.
• Set up repeatable customer onboarding covering account, SSO, VPC and monitoring.
• Set up cost governance and a clear view of what runs where and what it costs.
• Own DiVa's and Otto's contracts, including their scope, hard rules, process steps and handoffs to other agents.
• Turn repeated manual work into skills: small, deterministic Python tools with read-only doctor, list and plan verbs and gated mutating verbs.
• Keep and strengthen the safety rails: agents never delete, every change needs an up-front confirm stating cost and blast radius, guard hooks block destructive commands, and nothing goes to main without review.
• Check agent output by reading what they produce, testing it against real systems, and fixing the contract when an agent is wrong.
• Record decisions as Target Architecture Decisions (TADs) and keep shared memory accurate and sourced.
• Make infrastructure decisions independently and document them so others can follow.
• Work with architects, backend and frontend developers, QA and the Cloud Ops lead.
• Mentor colleagues who are new to Kubernetes or to working with agents.

What you'll need

• Senior to principal-level experience in DevOps, SRE or platform engineering, including running production systems.
• AWS in depth: EKS, IAM (including cross-account roles and SSO / Identity Center), VPC design (including shared VPCs, RAM, peering and endpoints), ECR, RDS, and Secrets Manager / SSM.
• Kubernetes in production: Helm or Kustomize, GitOps with ArgoCD, add-ons, network setup and rolling deploys.
• CI/CD experience, including GitLab CI and self-hosted runners.
• Container builds with multi-stage Dockerfiles, BuildKit and image scanning (Amazon Inspector).
• The JVM in containers: Spring Boot services, Gradle / Maven builds and Artifactory.
• Databases from an operator's view: Postgres and Oracle, connection pools, migrations (Liquibase) and password rotation.
• Scripting in Python and Bash, written to be clear, repeatable and safe.
• Hands-on work with AI coding agents (Claude Code or similar), or a strong wish to start.
• Safety by default: least privilege, no secrets in repos or images, confirm before mutating, and an understanding of what an SCP or a delete can break.
• Clear written English.

Nice to have

• Multi-tenant SaaS platform experience: tenant isolation, per-tenant data sources and "no tenant, no service" designs.
• Kafka / MSK, Apache Doris or another OLAP engine, and Debezium or other CDC tooling.
• Keycloak and OAuth2 / OIDC.
• Grafana, Prometheus and Loki across several AWS accounts.
• Moving legacy Java EE (WildFly) workloads to containers.
• Proxmox / LXC or other on-prem CI infrastructure.
• Writing prompts, agent contracts or evaluation suites for LLM agents.
• German is a strong plus.

Details

• Location: Bengaluru, India (TechGrove is based in Chennai, India).
• Recruitment notice: TechGrove may use AI tools to assist in screening and/or assessing applicants.