[Job- 31345]Senior DevOps Engineer (Cloud Network Foundation), Brazil

CI&T; Brasil; Hybrid; BRL 180,000 - 260,000; Full time

Benefits offered by this job

Seguro de saúde

Vale refeição

Vale alimentação

Auxílio creche

Wellbeing & learning benefits

PLR — participação nos resultados

Life insurance

CI&T University — learning platform

Job summary

A CI&T Brasil procura um(a) engenheiro(a) de redes com experiência em AWS para liderar a fundação de rede em múltiplas contas, com foco em Transit Gateway, VPCs segmentadas e inspeção centralizada.

Você definirá a postura de roteamento, testará a conformidade, projetará connect via GRE/BGP, gerenciará AWS IPAM e Terraform, e manterá logs e políticas de segurança.

Qualifications

• Experiência prática com redes em AWS, Transit Gateway e topologias hub-and-spoke.
• Conhecimento de GRE/BGP, Roteamento e inspeção de tráfego.
• Capacidade de planejar e justificar decisões de rede com base em evidências.

Responsibilities

• Gerenciar a base de rede end-to-end: Transit Gateway com tabelas de rota separadas para inspeção.
• Definir e impor a postura de roteamento para que o tráfego passe pelo firewall.
• Verificar a postura por meio de testes, não apenas por planos.
• Projetar e implementar Transit Gateway Connect com GRE e BGP.
• Gerenciar AWS IPAM com admin da organização e logs.
• Escrever Terraform em várias contas com GitHub OIDC.
• Implementar drift detection e validação estática.
• Gerenciar logs, políticas, e funções de serviço.

Skills

Transit Gateway

VPC design

Hub and spoke

Routing posture

GRE/BGP

English Advanced

Education

AWS Advanced Networking Specialty

Tools

Terraform

GitHub OIDC

AWS Network Firewall

AWS IPAM

Job description

At CI&T, we help large enterprises transform the potential of AI into real business impact with AI Deployment, AI-native execution, and tech-integrated business solutions.

With 30 years of experience in technological transformation, we accelerate innovation with expertise in Agentic SDLC, Application modernization, Data & AI, Martech and Business strategy.

We are 8,000 CI&Ters across more than 25 countries, collaborating to build solutions with real impact. AI is already part of how we work, evolve, and innovate every day.

You willco-own a multi-account AWS network foundation: hub and spoke on Transit Gateway, centralised inspection, controlled egress, hybrid connectivity into a client's SD-WAN estate through a third-party vendor. You will be in the room when the client's cloud architect asks why a subnet is a /25 and not a /24 - and the answer has to be yours.

The work is unglamorous in the way that matters. Most of what goes wrong in a landing zone does not go wrong in a module - it goes wrong at the seams.We want someone who has been burned by those and now checks for them by reflex.

Responsabilidades:

• Own the network foundationend to end: Transit Gateway with separated inspected and uninspected route tables, VPC design across inspection, egress, ingress, shared services, and workload tiers
• Define and enforce therouting posturethat makes traffic pass a firewall rather than merely sit near one
• Verify that postureby test, not by reading your own plan
• Design and implementTransit Gateway Connect over GRE with BGP, two peers for availability, ASNs agreed in advance
• Extract precise inputs fromthird-party SD-WAN vendorswho are not on your team and do not share your deadline
• ManageAWS IPAMwith a delegated organisation administrator, pool hierarchy mapped to accounts, RAM shares to spoke accounts
• Justifyevery prefix- "it looked tidy" is not an answer
• ImplementAWS Network Firewallwith stateful rule groups, default drop posture, domain allowlisting, and managed threat signatures
• Be the person who knows whether an application failing to reach the internet isthe firewall working correctly
• Write and maintainTerraform across multiple accountswith per-phase state separation, deployed throughGitHub OIDC
• Implement drift detection, static validation, and a pipeline thata client can inherit
• Manage log delivery into governance accounts, resource policies,KMS key policies, and service-linked roles
• Understand that these accept broken configurations silently - andprove delivery by watching a log arrive
• Write downwhy: why a prefix is what it is, why an option was rejected, what a deviation is
• Prevent the next engineer from reversing a deliberate choicebecause nobody recorded the reasoning
• Write downwhy: why a prefix is what it is, why an option was rejected, what a deviation is
• Prevent the next engineer from reversing a deliberate choicebecause nobody recorded the reasoning

Requisitos:

• Transit Gateway: association vs. propagation (no hedging), appliance mode, and why it exists
• VPC design: Network Firewall, NAT and egress control, PrivateLink, Route 53 Resolver
• Hands-on withhub and spoke and centralised inspection- built it, broke it, and fixed it(non-negotiable)
• Ability to describe arouting asymmetry you diagnosedor a firewall you had to prove was in the path
• Organizations, Control Tower, OUs, SCPs, delegated administrators, RAM
• Experienceinheriting a landing zonesomeone else deployed
• Module design,state layout across accounts and phases
• Read a plan and know before applying whether you are renaming ordestroyinga resource
• Site-to-site VPN or Direct Connect, GRE, BGP peering, route advertisement, ASN allocation
• Default tochecking the environmentrather than trusting a report - including your own
• Every serious problem was found by someonequerying the accountinstead of reading a summary
• Clear, precise, unhedged prose - adelivery skill, not a nice-to-have
• Inglês Avançado/Fluente é obrigatório

Diferencial:

• AWS Advanced Networking Specialty certification - or the equivalent scar tissue
• Experience withSD-WAN platforms on AWS(Cisco, Fortinet, Palo Alto) and Transit Gateway Connect
• Exposure tomanufacturing or industrial environments
• Familiarity withAWS Account Factory for Terraform (AFT)
• Working fluency in both Portuguese and English - client conversations in English; team works in Portuguese

Our benefits:

• -Health and dental insurance
• -Meal and food allowance
• -Childcare assistance
• -Extended paternity leave
• -Partnership with gyms and health and wellness professionals via Wellhub (Gympass) TotalPass;
• -Profit Sharing and Results Participation (PLR);
• -Life insurance
• -Continuous learning platform (CI&T University);
• -Discount club
• -Free online platform dedicated to physical, mental, and overall well-being
• -Pregnancy and responsible parenting course
• -Partnerships with online learning platforms
• -Language learning platform

And many more!

More details about our benefits here: https://ciandt.com/br/pt-br/carreiras

At CI&T, inclusion starts at the first contact. If you are a person with a disability, it is important to present your assessment during the selection process. See which data needs to be included in the report by clicking here. This way, we can ensure the support and accommodations that you deserve. If you do not yet have the assessment, don't worry: we can support you in obtaining it.

We have a dedicated Health and Well-being team, inclusion specialists, and affinity groups who will be with you at every stage. Count on us to make this journey side by side.