DevSecOps platform engineer in zero-trust

Cloudera; United States; Hybrid; USD 140,000 - 190,000; Full time

Benefits offered by this job

Generous PTO

Unplugged days

Flexible WFH policy

Wellness programs

Phone and Internet reimbursement

Career development

Comprehensive benefits

Volunteer time

Employee resource groups

Job summary

Cloudera seeks a senior platform engineer to design and operate multi-cloud Kubernetes environments using Terraform and GitOps patterns. You will implement Istio/Envoy service mesh configurations, policy gates with OPA, and standardized telemetry via OpenTelemetry across complex clusters.

Join a team driving secure, scalable deployments with ArgoCD/Flux, OIDC federation, and Vault-based secret workflows in a data-centric, enterprise context.

Qualifications

• 5+ years of production Kubernetes (EKS/AKS) experience.
• Bachelor’s degree in Computer Science, Engineering, Information Systems, or related field or equivalent experience.
• Advanced hands-on experience configuring Istio/Envoy service meshes, mTLS, edge gateways.

Responsibilities

• Design, provision, and maintain modular Terraform primitives and GitOps patterns for multi-cloud Kubernetes clusters (EKS/AKS).
• Operate Istio/Envoy service mesh topologies across multi-gateway perimeters (Public Ingress, B2B Ingress, Egress).
• Author and maintain Open Policy Agent (OPA / Rego) policies to enforce pre-flight deployment checks and access escalation gates.
• Configure OpenTelemetry collectors and Envoy proxies to emit uniform telemetry logs across all hops.
• Manage ArgoCD-based pull-based CD pipelines and enforce repository standards across teams.

Skills

Kubernetes

Terraform

GitOps

Istio/Envoy

OPA Rego

ArgoCD

Flux

OIDC

Vault

OpenTelemetry

CI/CD linting

Education

Bachelor’s degree in CS/Engineering or equivalent

Tools

ArgoCD

Flux

Terraform

Istio

Envoy

OPA

Vault

Job description

Описание:

At Cloudera, we empower people to transform complex data into clear and actionable insights. With as much data under management as the hyperscalers, we're the preferred data partner for the top companies in almost every industry. Powered by the relentless innovation of the open source community, Cloudera advances digital transformation for the world’s largest enterprises.

Задачи:

• Design, provision, and maintain modular Terraform primitives and GitOps patterns for multi-cloud Kubernetes clusters (EKS/AKS), software-defined networks, and pod identity layers.
• Operate Istio/Envoy service mesh topologies across multi-gateway perimeters (Public Ingress, B2B Ingress, Egress).
• Author and maintain Open Policy Agent (OPA / Rego) policies to enforce pre-flight deployment checks, Commit-as-Code format verification, and dynamic Just-in-Time (JIT) time-bound access escalation gates.
• Configure OpenTelemetry (OTel) collectors and Envoy sidecar proxies to emit uniform out-of-band JSON telemetry logs, stamping W3C traceparent headers and system primary keys (UPID, USID, correlation_id, process_id) across all network hops.
• Manage localized pull-based continuous delivery engines (ArgoCD) and construct automated structural linters to enforce the 10-Pillar Application Spoke Repository Standard across all engineering teams.

Требования:

• 5+ years of deep experience operating production Kubernetes (Amazon EKS, Azure AKS) and container security frameworks.
• Bachelor’s degree in Computer Science, Engineering, Information Systems, or a related field or equivalent experience.
• Advanced hands-on experience configuring Istio / Envoy service meshes, mTLS, custom ingress/egress routing, and edge API gateways.
• Practical expertise writing custom Open Policy Agent (OPA) rules in Rego for pipeline gating, admission controllers, or access governance.
• High proficiency with Terraform (modular structure design) and pull-based GitOps delivery tools (ArgoCD or Flux).
• Hands-on experience with OIDC identity federation, HashiCorp Vault, and short-lived secret workflows.
• Strong understanding of OpenTelemetry (OTel) instrumentation, W3C trace context propagation, and log aggregation pipelines.
• Будет плюсом: Familiarity with CI/CD linter construction for regular expression validation (Commit-as-Code); Background working within Hub-and-Spoke repository models and developer portal integrations.

Условия:

• Generous PTO Policy
• Support work life balance with Unplugged Days
• Flexible WFH Policy
• Mental & Physical Wellness programs
• Phone and Internet Reimbursement program
• Access to Continued Career Development
• Comprehensive Benefits and Competitive Packages
• Paid Volunteer Time
• Employee Resource Groups