Middle DevOps Engineer

• Own the AWS infrastructure for all platform environments (dev, staging, production and DR) through Terraform, with every change going through PR review and a pipeline plan.
• Operate and upgrade the EKS clusters, including Auto Mode node pools for CPU and GPU sandboxes, Gateway API routing, add-ons and capacity limits.
• Maintain the Bitbucket Pipelines and Helm GitOps flow that builds application images and promotes releases across environments.
• Run and test the disaster recovery setup: cross-region RDS replication, S3 and ECR replication, Step Functions failover, and fail-back. Keep RPO/RTO targets documented and verified.
• Keep the security baseline green: WAF rules, Security Hub (FSBP, CIS), GuardDuty, Inspector and IAM least privilege. Triage findings and remediate HIGH and CRITICAL ones.
• Run observability and alerting with Prometheus (AMP), Grafana, Loki and CloudWatch. Route alerts to the team's on-call channels, not a single mailbox.
• Onboard new white-label tenants: network, buckets, DNS, certificates and partner IP allowlists.
• Handle incidents and changes using the client's change process, and write short post-incident reports.
• Control AWS cost: right-size workloads, scale sandbox pools to zero when idle, and report monthly spend trends to the client.
• Keep runbooks, architecture pages and handover docs current in Confluence.
• Join client meetings, explain technical trade-offs in plain English, and respond to client request.
• Use AI-assisted engineering tools (e.g. Claude Code) responsibly to speed up IaC and pipeline work, with human review on every change.
• 5+ years in DevOps, SRE or platform engineering, with at least 3 years running production workloads on AWS
• Hands-on Amazon EKS in production: upgrades, node scaling (Karpenter or Auto Mode), ingress or Gateway API, IRSA or Pod Identity, troubleshooting
• Strong Terraform: multi-environment layout, reusable modules, remote state and locking, safe plan and apply in CI
• CI/CD with Bitbucket Pipelines or GitHub Actions, plus Helm and a GitOps workflow (ArgoCD, Flux or a Helm deploy repo)
• AWS networking and security: VPC design, NAT, VPC endpoints, peering, WAF, IAM, KMS, Secrets Manager, OIDC federation
• Disaster recovery on AWS: cross-region replication for RDS and S3, failover runbooks and DR drills
• Observability: Prometheus, Grafana, Loki or ELK/EFK, and alerting design
• Linux and scripting in Bash and Python
• Has worked in a regulated or security-sensitive domain (fintech, banking, payments) with ISO 27001 or SOC 2 style controls
• Can own a client environment end to end: clear written English and confident in client calls
• Can handle 2 or more projects at once and prioritise without close supervision

NICE TO HAVE

• AWS certifications: Solutions Architect Professional, DevOps Engineer Professional or Security Specialty; CKA or CKS
• Amazon Managed Prometheus/Grafana, ADOT and Grafana Alloy
• Velero backup and restore for Kubernetes
• Security tooling in pipelines: Trivy, tflint, SonarQube, Snyk
• Golang basics, enough to read services and debug builds
• Generative AI on AWS (Amazon Bedrock) or running AI-assisted engineering workflows
• Azure (AKS) experience for multi-cloud projects

Benefits

• International working environment with AI-driven strategic direction.
• 20 days of annual leave – Hybrid working mode.
• Premium healthcare package with BIC and comprehensive annual health check-ups
• Competitive salary & 13th salary bonus
• Lunch allowance to fuel your productivity.
• Engaging company culture with fun activities
• Global collaboration – Work with both Vietnamese and international colleagues.