Senior Plattform Engineer

Decskill; Lisboa; On-site; EUR 70,000 - 100,000; Full time

Job summary

Decskill is hiring a Senior Platform Engineer to lead platform upgrades, IaC migrations and high-availability improvements on AWS with EKS. You will manage OpenTofu and Terraform module migrations, implement self-healing and autoscaling, and optimize costs while ensuring secure access and compliance across pipelines.

The role requires 5+ years in DevOps/SRE or Platform Engineering, strong Kubernetes expertise, and fluency in Portuguese and English.

Qualifications

• 5+ years in DevOps, SRE or Platform Engineering.
• 3+ years running IaC on AWS in production.
• Hands-on with Terraform and OpenTofu including reusable modules and state management.
• Experience with EKS and Kubernetes lifecycle management.
• Knowledge of AWS resources (EC2, S3, IAM).
• Experience delivering production infrastructure migrations/upgrades with backup and rollback.
• Kubernetes skills: Helm, ingress, probes, HPA, PDBs.
• GitLab CI/CD, merge requests and pipelines.
• Vault for secrets management and IAM/RBAC, TLS fundamentals.
• Bash scripting and Linux administration.
• Familiar with Jira, Confluence and VSCode.
• Senior profile with autonomy and teamwork.
• Familiarity with Generative AI tools in IaC development.

Responsibilities

• Plan and run platform-component upgrades with backups and validated rollbacks.
• Migrate Terraform to OpenTofu modules; separate provisioning configs.
• Upgrade OpenTofu, Terraform and AWS provider with safe state handling.
• Deliver versioned IaC updates across platform components.
• Design high-availability and resilience improvements with platform owners.
• Maintain platform backups and recovery tests; ensure rapid recovery.
• Define availability actions for critical services and validate health.
• Improve monitoring and implement self-healing and autoscaling.
• Optimize EKS and AWS cost; rightsize and scheduled scaling.
• Maintain reusable OpenTofu/Terraform modules and Ansible automation.
• Work through GitLab MR workflows; integrate Vault secrets and least privilege.
• Remediate Checkmarx findings in IaC; verify fixes.

Skills

DevOps

SRE

Terraform

OpenTofu

AWS

Kubernetes

EKS

IaC

Bash

Linux

Jira

Confluence

GitLab CI/CD

Vault

TLS

Portuguese

English

Education

Bachelor’s degree in Computer Science or related

Tools

Terraform

OpenTofu

AWS

Kubernetes

Helm

GitLab

Vault

Jira

Confluence

VSCode

Job description

Decskill, founded in 2014 as an IT Consulting Company, places paramount importance on its greatest asset: its people. Our main mission is to deliver value through knowledge and talent, and we achieve this by fostering a culture of excellence and investing in the development and well-being of our people. With over 600 dedicated professionals and offices in Lisbon, Porto, Madrid, and Luxembourg, Decskill operates across three core areas:

Decskill Talent: We believe that our people are key to our success.

Through Decskill Talent, we empower our team to embrace the digital transformation challenges of our clients. We collaborate with clients to drive innovation, ensuring project success and business growth.

Decskill Boost: Equipping our team with the latest tools and methodologies, we optimize Time-to-Market and deliver innovative solutions exceeding client expectations.

Decskill Connect: Our team collaborates closely with clients to implement and manage IT infrastructures that generate long-term value.

At Decskill, we believe that by nurturing and empowering our people to confront the challenges of digital transformation, we create value not only for our clients but also for our entire ecosystem, fostering a digital community dedicated to growth and progress.

We are looking for a Senior Plattform Engineer

Responsibilities:

• Plan and run controlled platform-component upgrades, with a prior backup, tested rollback or restore procedures, approved maintenance windows and post-upgrade validation;
• Migrate legacy Terraform code into reusable OpenTofu modules and separate provisioning configurations. Keep codebase migration and application upgrades separately scoped, preserving existing behaviour unless a change is approved;
• Upgrade OpenTofu, Terraform and the AWS provider with compatibility checks and safe state handling. Review plans for unintended destruction or replacement, resolve unexpected changes before authorised applies, and validate services afterwards;
• Deliver critical version and dependency updates across platform components through versioned IaC and controlled releases;
• Design and implement high-availability and resilience improvements with platform owners, including failover testing where applicable;
• Keep platform and Kubernetes backup and restore procedures tested, with measured recovery times and evidence of successful recovery;
• Define and implement availability actions for critical services, validating service health against agreed criteria before and after changes;
• Improve monitoring and alerting, and implement self-healing through probes, auto-restart, autoscaling and controlled automated remediation;
• Optimize EKS and AWS cost and capacity in pre-production and production through rightsizing and, where service requirements allow, scheduled scaling or start/stop;
• Maintain reusable OpenTofu/Terraform modules and Ansible automation, semantic versioning, shared GitLab CI/CD pipeline integrations, resource naming/tagging and automated tests;
• Work through GitLab merge requests and approval workflows, integrate pipelines with Vault for secrets and AWS access, and apply least privilege and segregation of duties;
• Remediate Checkmarx findings in IaC modules and verify fixes through the established scanning and review process;
• Write technical designs, ITIL-aligned operational procedures for upgrades, backup/restore and observability, and monthly progress reports in Confluence;
• Take over ongoing work, run knowledge-transfer sessions, and coordinate with platform owners and third parties on access, maintenance windows and production approvals;
• Work in Scrum with sprints using Jira and Confluence.

Requirements:

• 5+ years in DevOps, SRE or Platform Engineering, including 3+ years running Infrastructure as Code on AWS in production;
• Strong hands-on experience with both Terraform and OpenTofu, including reusable, versioned modules, separate provisioning configurations, state management and AWS provider upgrades;
• Production experience with Amazon EKS and practical knowledge of cluster, add-on and node-group lifecycle management, plus solid knowledge of AWS resources such as EC2, S3 and IAM;
• Evidence of safely delivering production infrastructure migrations or upgrades, including risk assessment, backup, tested rollback/restore, change approval and post-change validation;
• Solid Kubernetes skills, including Helm, ingress controllers, probes, HPA and PodDisruptionBudgets;
• Working knowledge of high availability, backup/restore and recovery testing for stateful services and Kubernetes workloads;
• Monitoring and alerting experience, including using service-health evidence to assess the impact of changes;
• Strong GitLab CI/CD experience: merge requests, pipelines, reusable pipeline integrations, branch protection and approval controls;
• Practical Vault experience for secrets management and CI/CD integration, together with IAM/RBAC, least privilege and TLS fundamentals:
• Ability to investigate and remediate Checkmarx findings in IaC;
• Strong Bash scripting and Linux administration;
• Familiarity with Jira, Confluence and VSCode;
• A senior profile, comfortable with technical autonomy while respecting peer review, segregation of duties and production approvals;
• Familiarity with Generative AI (GenAI) and agentic tools to support IaC project development, optimization, and automation, including GitHub Copilot and other LLM-powered development clients;
• Fluent Portuguese and English.

What will be a plus:

• Advanced IaC module testing, migration automation and orchestration;
• Experience with Kubernetes node operating-system or ingress-controller migrations;
• Stateful-service administration and HA design, including PostgreSQL backup/restore and failover testing, or Vault HA;
• Kubernetes backup tooling such as Velero, and automated recovery/self-healing;
• SLO/SLI definition, cost analysis and capacity optimization;
• Experience with other CI/CD tools, such as Jenkins, and configuration as code.
• Enterprise identity integration and Python or Go scripting;
• Familiarity with data-platform workloads and their operational dependencies;
• Relevant Terraform, Vault, AWS, Kubernetes or ITIL certifications;
• Availability for occasional pre-agreed maintenance windows during upgrades.

Decskill is committed to equality and non-discrimination with all our talents. We recruit and promote talent, based on diversity and inclusion, regardless of age, gender, ethnicity, race, nationality or any other form of discrimination incompatible with the dignity of the human being.