Senior Infrastructure Engineer

Equiti Group; Bengaluru; On-site; INR 2,500,000 - 4,000,000; Full time

Job summary

Equiti Group is seeking a skilled Cloud Infrastructure/SRE professional to design, operate, and optimise production-grade GCP environments in Bengaluru. You will standardise Cloud Run patterns, manage VPCs and DNS, and implement secure, scalable connectivity.

The role requires hands-on experience with Cloud Build, Secret Manager, KMS, and load balancers, along with strong IAM practices and cost controls. Mentoring and documenting runbooks are part of the job.

Qualifications

• 4-6 years of cloud infrastructure/SRE experience.
• Hands-on with GCP services: Cloud Run, Cloud Build, Cloud DNS, Cloud NAT/Router.
• Strong networking fundamentals (TCP/IP, DNS, NAT).
• Proven cost management, monitoring, and incident handling.
• Security-first mindset with IAM, MFA, and encryption practices.

Responsibilities

• Design and operate production-grade GCP environments.
• Standardise Cloud Run service patterns and deployments.
• Plan and manage VPCs, DNS, and private connectivity.
• Implement backups, DR, and HA strategies.
• Mentor junior engineers and document runbooks.
• Collaborate with clients to ensure security and compliance.

Skills

GCP Expertise

Cloud Run

Cloud DNS

VPC & Networking

IAM & Security

Cost Management

Observability

Tools

Cloud Build

Secret Manager

KMS

VPC Service Connect

LBs/Proxies

Job description

GCP Architecture and Operations:

• Design, build, and operate production-grade environments on GCP (projects, folders, and org policies).
• Standardise Cloud Run service patterns (revisions, concurrency, autoscaling, min/max instances, and VPC access).
• Implement Cloud Build pipelines (triggers, build steps, artefacts, and promotions) and manage secrets (Secret Manager).

Networking (Deep):

• Plan and manage VPCs, subnets, firewall rules, routes, shared VPCs, and private Google Access.
• Configure Cloud NAT, Cloud Router, VPC Peering/Network Connectivity Centre, and Private Service Connect.
• DNS design and operations with Cloud DNS (zones, split-horizon, forwarding, policy, and health checks).

Load Balancing and Proxies:

• Architect and operate external/internal HTTP(S), TCP/UDP (network), and proxy load balancers.
• URL maps, host/path routing, backend services, NEG types (serverless NEGs for Cloud Run), health checks, and session affinity.
• TLS termination/offload, Google-managed certificates, and mTLS where applicable.

Security and Compliance:

• Network controls (hierarchical firewall policies, perimeter designs, and VPC-SC where needed).
• Ensure infrastructure designs and configurations support PCI DSS controls related to:
• Network segmentation between cardholder data environments (CDE) and non-CDE systems.
• Firewall and VPC rules: restrict inbound/outbound traffic and maintain a deny-by-default posture.
• Encryption standards: enforce TLS 1.2+ for data in transit and AES-256 or Google-managed CMEK for data at rest.
• Access management: implement least-privilege IAM, service-account separation, and MFA on administrative accounts.
• Change management: follow approved processes for infrastructure and DNS/network modifications.
• Vulnerability management: ensure patching cadence and vulnerability scans across compute and containerised workloads.
• Audit logging and monitoring: maintain Cloud Audit Logs, VPC Flow Logs, and GCS access logs with immutable retention and alerting.

Reliability, DR, and HA:

• Multi-zone/region strategies and RTO/RPO definitions and testing.
• Backups and restore runbooks (Cloud SQL, GCS, and Firestore), traffic failover patterns, and dependency maps.

Observability and Cost Management:

• Logging/metrics/tracing with Cloud Monitoring and Cloud Logging; SLO/SLA/SI targets.
• Cost visibility: labels/tagging standards, budgets and alerts, committed use discounts, and rightsizing.

Platform and Containers:

• Container build hardening (distroless/base image strategy), SBOMs, and vulnerability scanning.
• Runtime policies, connection management (DB proxies, private endpoints), and performance tuning of Cloud Run (cold start, CPU always on).

Enablement and Collaboration:

• Write concise runbooks, diagrams, and architecture docs.
• Mentor junior engineers; provide a client-first support mindset and pragmatic guidance.

Requirements:

• Strong IAM hygiene (least privilege, service accounts, workload identity federation).
• 4-6 years in cloud infrastructure/SRE with at least 3 years on GCP.
• Hands-on with Cloud Run, Cloud Build, Cloud DNS, Cloud NAT/Router, LBs, Secret Manager, and KMS.
• Strong networking fundamentals (TCP/IP, BGP basics, CIDR, NAT, proxies, DNS).
• Proven track record in cost management, monitoring/alerting, and production incident handling.
• Solid grasp of DR/HA, RTO/RPO, backup/restore, and traffic failover.
• SSL/TLS: cert lifecycle, cyphers, HSTS basics, and Google-managed certs on LBs.