Devops Engineer

Agentra Ai Services; Gurugram District; On-site; INR 1,800,000 - 2,400,000; Full time

Job summary

Agentra Ai Services is seeking a Senior DevOps/SRE with strong Google Cloud production experience. You will own infrastructure as code with Terraform, manage private GKE clusters, and lead SRE practices including observability and disaster recovery.

You will migrate workloads to GKE, build robust CI/CD pipelines, enforce security baselines, and drive FinOps. Collaboration with founders and engineering teams is essential to ensure reliable, scalable cloud platforms.

Qualifications

• 5–8 years in DevOps, SRE, or platform engineering with Google Cloud production experience.
• Deep Kubernetes expertise, including private GKE, networking, ingress, and upgrades without downtime.
• Terraform as primary IaC language; Python or Bash for scripting.
• Strong cloud networking knowledge: VPCs, NAT, firewalls, DNS, and WAF integration.
• Experience with data services and observability practices, backups, and DR testing.
• Familiarity with SOC 2 / ISO 27001 or security reviews.

Responsibilities

• Own IaC for landing zone in Terraform across IAM, VPC, subnets, and load balancing.
• Handover validation from migration partner and gap closing.
• Migrate ECS to GKE, storage transfers, DNS cutover.
• Operate GKE with autoscaling, RBAC, workload identity, upgrades.
• Manage data services (MongoDB Atlas, Redis Memorystore, Cloud SQL) including backups.
• Build CI/CD pipelines with Cloud Build, GitHub Actions, Argo CD.
• Maintain observability stack (OpenTelemetry, Cloud Logging/Monitoring, Prometheus/Grafana).
• Drive cost engineering and FinOps dashboards.
• Enforce enterprise security baseline and IAM least privilege.
• Produce deployment blueprints for AKS and EKS and verify with customers.
• Define SLOs, incident response, postmortems.

Skills

Terraform

Kubernetes

GCP

Python

Bash

Observability

CI/CD

Argo CD

Networking

Cost optimization

Job description

Role & responsibilities

• Own infrastructure as code in Terraform for the full landing zone: IAM, VPC and subnets, firewall rules, Cloud NAT, global HTTPS load balancing (ALB and NLB), Cloud Armor, private regional GKE clusters and node pools, Compute Engine, Cloud Storage, Persistent Disk, Cloud SQL, Memorystore, Cloud KMS, Secret Manager, Artifact Registry, and Cloud DNS, with environments reproducible from an empty project.
• Accept the handover from our migration partner, validate every deliverable against the scope, and close the gaps they excluded: application process monitoring and alerting, runbooks, and day-two operations.
• Complete the migration: ECS workloads to GKE, S3 data to Cloud Storage via Storage Transfer Service, remaining VMs, and the DNS cutover to the new load balancer.
• Operate GKE well: namespaces, Kubernetes service accounts and RBAC, workload identity, cluster and node-pool autoscaling, ingress, upgrades without downtime, and GPU node pools with vLLM for open-weight models.
• Run the data services: MongoDB Atlas from the GCP Marketplace, Confluent Cloud Kafka, Debezium on GKE, Memorystore Redis, and Cloud SQL, including backups, restore tests, and disaster recovery.
• Build CI/CD with Cloud Build and GitHub Actions and Argo CD, with images and packages in Artifact Registry, signed images, SBOMs, and vulnerability scanning in the pipeline.
• Run the observability stack: OpenTelemetry collectors, Cloud Logging and Cloud Monitoring, Prometheus and Grafana, VPC Flow Logs, and per-tenant cost and token telemetry.
• Drive cost engineering: spot and preemptible node pools, autoscaling to zero, committed-use discounts, right-sizing the n2d and highmem pools, and a FinOps dashboard the founders check weekly.
• Implement and maintain the enterprise security baseline: organization policies (public access prevention, no external IPs, no service-account keys or uploads, uniform bucket-level access, restricted serial port access, trusted images only, no default network), least-privilege IAM, CMEK with Cloud KMS, Secret Manager, VPC Service Controls, Private Service Connect, SSO, CIS benchmarks, and SOC 2 evidence.
• Produce deployment blueprints for AKS and EKS and validate them with a real customer deployment.
• Define SLOs, run incident response, and write the postmortems.

Preferred candidate profile

• 5 to 8 years in DevOps, SRE, or platform engineering, with production depth on Google Cloud.
• Kubernetes beyond the basics: private GKE, networking and ingress, autoscaling, workload identity, upgrades without downtime.
• Terraform as your primary language for infrastructure, plus Python or Bash for everything else.
• Cloud networking you can draw from memory: VPCs and subnets, NAT, firewall rules, load balancer tiers, private DNS, and how a WAF sits in front of all of it.
• Operating at least one of Kafka, MongoDB, or Redis in production, and a habit of testing backups by restoring them.
• Observability as a practice, not a product install.
• Exposure to compliance work: SOC 2, ISO 27001, or customer security reviews.
• Experience taking over infrastructure built by someone else and making it yours.