Cloud Engineer

The short version

The prime focus is Kubernetes on hardware we own: clusters on metal, and tenant clusters those hosts provision. Git is the only path to production. You would own that platform.

You will not get an interview on Active Directory and Microsoft 365 alone, and you will not get one on a Kubernetes certificate alone. On-prem Exchange is useful. It is not the job.

The stack you will work with

Kubernetes (kubeadm, Cluster API, KubeVirt, hosted control planes, AKS), Flux, Kustomize, Helm, Harbor, Keycloak, Active Directory, Entra ID, Entra Connect, Microsoft 365, Exchange Online, VMware vSphere/ESXi, Windows Server, Cisco UCS, OpenTofu, Ansible, PowerShell, Prometheus, Grafana, AlmaLinux, Ubuntu, Go, Python, Bash

What you would own

• Cluster lifecycle across bare-metal, virtualised and managed cloud layers, including etcd backup and restore, certificate rotation, upgrades, RBAC and admission.
• GitOps as the operating model using Flux, Kustomize and Helm, with infrastructure as code via OpenTofu or Terraform and Ansible.
• Cluster networking and storage as a platform consumer, including Gateway API, ingress, NetworkPolicy, StorageClasses, PVCs and snapshots.
• Active Directory and hybrid identity, including forest and domain design, Group Policy, Entra ID, Entra Connect, enterprise DNS and DHCP, and Windows Server lifecycle.
• Microsoft 365 and application mail, including Exchange Online, hybrid mail flow, SMTP relay, OAuth 2.0, SPF, DKIM and DMARC.
• VMware and KubeVirt virtualization, including vSphere/ESXi, vCenter and VM lifecycle.
• Platform services such as Harbor, Keycloak, secrets, cert-manager and image policy.
• Kubernetes-native backup and restore with Velero, Kopia and etcd snapshots, proven by restoring.
• Observability and reliability with Prometheus and Grafana, on-call rotation, incident command and root cause analysis.
• Repeatable provisioning of physical servers, including out-of-band management, RAID, SAN/NAS attach, Cisco UCS, kubeadm or Cluster API.

What the first year looks like

• Make cluster create, upgrade and retire a GitOps path that someone other than you can run.
• Establish verified high availability on production.
• Establish provable backup and restore for the Kubernetes platform and its stateful workloads.
• Bring Active Directory, hybrid identity, Microsoft 365 and the VMware estate under the same operating standard as the Kubernetes platform.
• Remove single points of knowledge across the platform.

What we need you to have done

• Production Kubernetes you have operated, including cluster lifecycle.
• Certified Kubernetes Administrator (CKA), or equivalent depth you can demonstrate live. CKS or CKAD is a plus.
• Production Active Directory and Microsoft 365 you have operated, including multi-site or multi-domain AD, Entra Connect, Exchange Online and hybrid mail flow.

Kubernetes, the majority of the role

• 8+ years in infrastructure engineering, with production Kubernetes a substantial part of recent work.
• Control-plane depth including etcd operations, cluster upgrades, RBAC and admission, scheduling, and failure diagnosis.
• GitOps in production with Flux or ArgoCD, Kustomize and Helm.
• Cluster API and KubeVirt, or the equivalent, with KVM underneath expected.
• Working knowledge of Kubernetes networking and storage as a cluster operator.
• Linux fundamentals on RHEL/AlmaLinux or Ubuntu.
• Restores you have personally performed for clusters or etcd using Velero, Kopia or equivalent.
• Prometheus and Grafana in production. Thanos or Loki is a plus.
• Harbor and Keycloak experience, or the depth to take both on.

Windows identity and Microsoft 365, you arrive with this

• Hands-on Active Directory, Entra ID and Entra Connect, including enterprise DNS and DHCP failover.
• Microsoft 365 in production, including Exchange Online, hybrid mail flow and Azure administration fundamentals.
• Application mail flow using SMTP relay, OAuth 2.0 and SPF, DKIM and DMARC.
• Windows Server in production, including Windows worker nodes in Kubernetes.
• PowerShell as a working tool, plus OpenTofu or Terraform, Ansible, Bash, and Python or Go.

Hardware and virtualization

• Physical server work including IPMI, iLO, iDRAC, RAID, SAN/NAS attach and Cisco UCS.
• VMware vSphere/ESXi in production, including hosts, vCenter, clusters and VM lifecycle.
• Bachelor's degree in Computer Science, Information Technology, or equivalent practical experience.
• Clear writing, an ownership mindset, and troubleshooting across identity, mail flow, networking and storage.

Nice to have

• Cilium in production, Ceph and CSI operations, and datacenter networking such as VLANs, LACP, BGP and VXLAN.
• Experience building and operating bare-metal Kubernetes, and Azure experience with AKS and hybrid connectivity.
• On-prem Exchange Server 2016/2019/SE, eDiscovery and Microsoft Purview, conditional access, Intune and Entra ID security tooling.
• Thanos, Loki, Tempo, Flatcar Container Linux, OpenBao.
• Experience in a FedRAMP, SOC 2 or comparable regulated environment.
• Red Hat (RHCSA/RHCE), Ceph, Isovalent/Cilium, HashiCorp Vault, or Azure (AZ-104 / AZ-305) certification.
• Contributions to open-source infrastructure projects.

Boundaries

Backup responsibility is split across three roles. This role owns Kubernetes-native stateful backup as part of the platform. The Senior Storage Engineer owns the storage and backup platform beneath it. The Manager, Data Platform owns database backup and point-in-time recovery.

How the team works

• You would join the IT Infrastructure team and work directly with network, storage, security and the application platform teams.
• On-call is a shared rotation, not a permanent state. Major incidents escalate to the whole team.
• We expect ownership rather than ticket-taking.
• Based in Noida, India. Relocation is funded.
• This role is a step toward platform architecture ownership as the Noida centre grows.

Benefits

apexanalytix offers competitive benefits for the countries that we serve, in addition to our BeWell@apex initiative that encourages employees' growth in six key wellness areas. Resources include a Mentor Program, Internal Training Portal, and Education, Tuition, and Certification Assistance.