DevOps Engineer - Banking Industry

Overview

Key Responsibilities

• **Infrastructure as code**: Own and maintain all AWA Azure infrastructure in Terraform/Bicep: AKS 5-namespace cluster, ADLS Gen2 accounts with WORM policies, Azure AI Foundry APIM configurations, Azure Firewall allowlists, private endpoints, Key Vault, Container Registry, ExpressRoute peering.
• **CI/CD pipeline ownership**: Design and maintain Azure DevOps pipelines for all AWA components: container image build → ACR push → Notary v2 signing → AKS deployment; Terraform plan → policy check → apply; Agent Regression Testing gate on every PR.
• **AKS operations**: Manage the 5-namespace AKS cluster — namespace isolation, Network Policies, Pod Disruption Budgets, KEDA autoscaling rules based on Kafka consumer lag, OPA Gatekeeper admission policies, Workload Identity bindings for all agent pods.
• **Container governance**: Manage ACR, enforce Notary v2 image signing, configure vulnerability scanning, maintain the approved-image ConfigMap used by OPA Gatekeeper admission control.
• **Secret and certificate management**: Own Azure Key Vault configuration — access policies per managed identity, automatic TLS certificate rotation, secret rotation schedules, audit of all secret access events.
• **Monitoring and alerting**: Configure Azure Monitor alert rules and Log Analytics KQL queries for SLA breach, error rate spike, pod crash loop, token budget breach, and Kafka consumer lag; maintain PagerDuty escalation paths.
• **Security posture**: Work with the AI Security Engineer to implement Azure Policy assignments, Defender for Cloud recommendations, Firewall rule reviews, and Private Endpoint configurations; maintain the AWA network topology diagram.
• **Disaster recovery**: Maintain and test DR procedures: failover to UAE South replica for ADLS Gen2, Azure AI Foundry PTU → PAYG → DR endpoint routing, Orkes cluster recovery, RTO/RPO validation.

Required Skills and Experience

• Technical — Essential
• 5+ years DevOps/Platform Engineering; 2+ years on Azure
• Terraform or Bicep — production IaC, not just templates
• Kubernetes / AKS: namespaces, RBAC, Network Policies, Helm charts, Kustomize
• Azure DevOps or GitHub Actions — multi-stage pipelines, approvals, environments
• Azure Monitor, Log Analytics, KQL query language
• **Container ecosystem**: Docker, ACR, image signing, admission control
• **Azure networking**: VNet, private endpoints, NSGs, Azure Firewall, ExpressRoute concepts
• **KEDA** (Kubernetes Event-Driven Autoscaling) or equivalent autoscaling experience
• Technical — Advantageous
• Azure Key Vault, managed identity, Workload Identity for Kubernetes
• OPA Gatekeeper or Kyverno for Kubernetes policy enforcement
• Kafka / Azure Event Hubs — consumer group management, lag monitoring
• ADLS Gen2, WORM immutable storage, lifecycle management policies
• Azure AI Foundry / APIM — token quotas, rate limiting, backend routing configuration
• Security tooling: Defender for Cloud, Sentinel, Notary v2

Qualifications

• Bachelor's degree in Computer Science, Systems Engineering, or equivalent
• Azure Administrator Associate (AZ-104) or DevOps Engineer Expert (AZ-400) strongly preferred
• Certified Kubernetes Administrator (CKA) advantageous
• Pay: AED17,000.00 - AED21,000.00 per month

Application Question(s)

• Describe an Azure environment you have fully deployed using Terraform or Bicep (scope, components, scale).
• How do you ensure your IaC is reusable, modular, and compliant with policies?
• Have you built end-to-end CI/CD pipelines for infrastructure and application deployments (e.g., Azure DevOps)?
• What steps do you include in a secure CI/CD pipeline (e.g., image signing, policy checks, testing gates)?
• What is your hands-on experience managing production AKS clusters?
• Have you implemented Kubernetes features such as Network Policies, Pod Disruption Budgets, or namespace isolation?
• Do you have experience with KEDA-based autoscaling (event-driven scaling)?
• Have you managed Azure Container Registry (ACR) with image governance (signing, vulnerability scanning)?
• Are you familiar with admission control tools like OPA Gatekeeper? If yes, how have you used them?
• What is your experience with Azure Key Vault for secret and certificate management?
• Have you implemented managed identities or workload identities in Kubernetes?

Experience

• DevOps/Platform Engineering: 4 years (Preferred)
• Azure in production environments: 4 years (Preferred)
• production experience with Terraform or Bicep: 4 years (Preferred)