Infra & Platform Architect

Crew Kraftorz LLP; Hyderabad; On-site; INR 4,000,000 - 6,000,000; Full time

Job summary

Crew Kraftorz LLP is seeking an Infra & Platform Architect in Hyderabad to own the end-to-end infrastructure blueprint. You will design multi-cloud IaC, Kubernetes platform engineering, and zero-trust security, while leading SRE, DevOps, and AppSec engineers.

You will contribute hands-on code and drive design decisions to meet NFRs. The role requires 10+ years in infrastructure/cloud architecture with 3+ years in principal/architect-level leadership.

Qualifications

• 10+ years of professional infrastructure/platform engineering or cloud architecture.
• At least 3 years in principal/staff/architect level roles with platform-wide impact.
• Proven Kubernetes platform ownership at production scale across multiple clouds.
• End-to-end CI/CD and GitOps ownership with security gates and rollback procedures.
• Secrets management architecture experience with HashiCorp Vault or equivalent.

Responsibilities

• Own end-to-end infrastructure architecture across multi-cloud, Kubernetes, and platform data stores.
• Govern CI/CD and GitOps pipelines, including canary deployments and release gates.
• Define platform observability, SRE, and incident response architectures.
• Own zero-trust security posture with Istio mTLS, gateway security, and policy enforcement.
• Lead a small team of SRE/DevOps/Security engineers and drive ADRs.

Skills

Technical leadership

Architecture governance

Cross-functional collaboration

Cloud-agnostic design

Hands-on coding

Tools

AWS (EKS)

Kubernetes

Terraform

Terragrunt

GitHub Actions

GitLab CI

ArgoCD

Istio

Kong Gateway

Prometheus/Grafana/OpenTelemetry

Vault (HashiCorp)

Job description

JD: Infra & Platform Architect
Exp.: 10+ years (3+ years in a Principal or Architect-level role)

Work Location: Hyderabad
Work Timing: General Shift
Work Mode: WFO
Notice Period: Immediate

JOB SUMMARY:

The Infrastructure & Platform Architect is the technical authority for every infrastructure, DevOps, and security decision on this platform. You will design and own the end-to-end infrastructure blueprint from multi-cloud IaC to Kubernetes platform engineering, from GitOps delivery pipelines to zero-trust security posture — and lead the three engineers (SRE, DevOps, AppSec) who implement and operate it. This is an IC-led architecture role: you contribute hands-on code, review every significant design decision, and are accountable for the platform meeting its published NFRs

KEY RESPONSIBILITIES:

1. End-to-End Infrastructure Architecture

• Design and own the cloud-agnostic Kubernetes platform architecture across AWS (EKS)
• Define the multi-cloud IaC strategy: Terraform / Terragrunt module hierarchy, remote state topology, per-environment promotion model, and zero-drift enforcement.
• Architect the production Kubernetes clusters: node group strategy (general, GPU A10G for SLM serving, high-memory for graph workloads), autoscaling (Karpenter / Cluster Autoscaler), namespace topology, RBAC model, and network policy design.
• Own the networking architecture: VPC/VNet design, private endpoint strategy, ingress topology (Kong Gateway), and Istio service mesh configuration for STRICT mTLS across all 53 agent workloads.
• Define infrastructure for all specialised platform data stores: Neo4j Enterprise 5.x (3‑core causal cluster + read replicas), PostgreSQL 16 (JSONB partitioned agent execution log), Redis 7.2+ Enterprise (hot-path workflow cache), Weaviate 1.25+ (per-app vector collections), and Apache Kafka 3.7+ (500K events/day, 12 partitions).
• Define GPU infrastructure: A10G node pool configuration, NVIDIA device plugin, CUDA driver compatibility, and HPA triggers for vLLM serving pods running Mistral 7B and Phi-3 Mini Q4.

2. DevOps Platform & Delivery Engineering

• Design and govern the CI/CD architecture: GitHub Actions / GitLab CI pipeline templates covering build, lint, unit test, integration test, SAST (Semgrep), container scanning (Trivy), agent eval gates (80% pass rate), staging deploy, and manual production promotion.
• Own the GitOps delivery model: ArgoCD App-of-Apps topology, ApplicationSets per environment, auto-sync staging, manual production gates, and Helm chart standards across all 6 service layers.
• Define canary deployment strategy using Flagger + Istio traffic splitting, with Prometheus‑based promotion criteria and automatic rollback.
• Architect the image supply chain: multi‑stage Dockerfiles, Cosign/Notary image signing, ECR / GCR lifecycle policies, and SBOM generation integrated into every release.
• Design the secrets management architecture: HashiCorp Vault HA cluster on Kubernetes, KV v2, database secret engine for PostgreSQL / Neo4j / Weaviate, PKI engine for internal certificates, AppRole and Kubernetes auth methods, and Vault Agent Injector configuration.

3. Platform Observability & SRE Architecture

• Define the observability architecture: Prometheus 2.53 + AlertManager + Grafana 11 stack, OpenTelemetry 1.x distributed tracing (Grafana Tempo in production, Jaeger in dev), and Grafana Loki for structured log aggregation.
• Define the incident response architecture: PagerDuty routing rules, escalation policies, on‑call rotation structure across the SRE and DevOps engineers, and the PIR process that feeds improvements back into runbooks and chaos experiments.
• Design the synthetic monitoring and load‑testing strategy: Grafana k6 / Checkly critical journey heartbeats, 500‑concurrent‑workflow load test gates in CI.

4. Platform Security Architecture & Compliance

• Own the zero‑trust security architecture: Istio STRICT mTLS across all service‑to‑service communication, Kong Gateway JWT validation and WAF at the perimeter, OPA/Kyverno admission policies, and PodSecurityAdmission enforcement.
• Define the identity and access architecture: Okta / Azure AD OIDC + SAML integration for the HITL UI and KB Management UI, MFA enforcement for admin roles, IRSA for AWS workload identity, and Workload Identity for GCP.
• Design the DevSecOps pipeline security gates: Semgrep SAST (custom rules for Python, TypeScript, Terraform), Trivy container scanning (zero CRITICAL CVE gate), OWASP ZAP DAST against HITL and KB UI endpoints, and SBOM artefact management.
• Architect the runtime security layer: Falco anomaly detection rules tuned to platform normal behaviour, GuardDuty / Security Hub integration, and CloudTrail / audit log immutability.
• Own the SOC 2 Type II infrastructure controls: audit_log immutability (PostgreSQL append‑only, no UPDATE/DELETE), 2‑year retention, 90‑day HITL decision retention, and the controls matrix mapping platform design to CC6/7/8 trust service criteria.
• Lead LLM‑specific threat modelling: prompt injection vectors for the 53‑agent system, tool‑call abuse paths (Jira, GitLab, XRay APIs), context manipulation via Weaviate retrieval, and model inference boundary controls for the SLM serving layer.

5. Technical Leadership & Team Development

• Directly lead three engineers: SRE Platform Engineer, DevOps & Cloud Infrastructure Engineer, and Security Engineer (AppSec & Compliance) — setting technical direction, owning their work quality, and growing their capabilities.
• Write and maintain Architecture Decision Records (ADRs) for all significant infrastructure choices; serve as the infrastructure representative on the Architecture Board reviewing ASDLC‑ARCH documents.
• Define and enforce infrastructure engineering standards: IaC module quality, runbook completeness, DR procedure fidelity, and on‑call readiness across the team.
• Act as the primary escalation path for P1 incidents that exceed the SRE engineer's scope; lead post‑incident reviews that produce durable systemic improvements.
• Partner with the six application engineering teams to design self‑service infrastructure capabilities — developer experience tooling, internal platform APIs, Backstage service catalogue integration — that reduce platform team as a bottleneck.

Background & Education:

Experience:

• 10+ years of professional experience in infrastructure engineering, platform engineering, or cloud architecture — with at least 3 of those years operating at a principal, staff, or architect level where you made design decisions with platform‑wide consequences, not just implemented them.
• Demonstrable experience designing and owning a Kubernetes‑based platform at production scale — not administering a cluster that someone else designed. You have made the node pool, networking, and RBAC decisions, written the Terraform modules from scratch, and been accountable for the platform's availability targets.
• Production multi‑cloud experience at the architecture level: you have provisioned and operated workloads on at least two cloud providers and you understand where the abstractions hold and where they break. Cloud‑agnostic IaC is not a design principle to you — it is something you have actually delivered.
• End‑to‑end CI/CD and GitOps ownership: you have designed a delivery platform that engineers other than yourself use daily — including the security gates, approval workflows, and rollback procedures — and you have improved it based on post‑incident analysis.
• Secrets management architecture experience: you have designed and operated HashiCorp Vault (or an equivalent) in production, including auth method configuration, secret engine design, lease TTL governance, and rotation policy — not just called the API.