- Own the AWS infrastructure for all platform environments (dev, staging, production and DR) through Terraform, with every change going through PR review and a pipeline plan.
- Operate and upgrade the EKS clusters, including Auto Mode node pools for CPU and GPU sandboxes, Gateway API routing, add-ons and capacity limits.
- Maintain the Bitbucket Pipelines and Helm GitOps flow that builds application images and promotes releases across environments.
- Run and test the disaster recovery setup: cross-region RDS replication, S3 and ECR replication, Step Functions failover, and fail-back. Keep RPO/RTO targets documented and verified.
- Keep the security baseline green: WAF rules, Security Hub (FSBP, CIS), GuardDuty, Inspector and IAM least privilege. Triage findings and remediate HIGH and CRITICAL ones.
- Run observability and alerting with Prometheus (AMP), Grafana, Loki and CloudWatch. Route alerts to the team's on-call channels, not a single mailbox.
- Onboard new white-label tenants: network, buckets, DNS, certificates and partner IP allowlists.
- Handle incidents and changes using the client's change process, and write short post-incident reports.
- Control AWS cost: right-size workloads, scale sandbox pools to zero when idle, and report monthly spend trends to the client.
- Keep runbooks, architecture pages and handover docs current in Confluence.
- Join client meetings, explain technical trade-offs in plain English, and respond to client request.
- Use AI-assisted engineering tools (e.g. Claude Code) responsibly to speed up IaC and pipeline work, with human review on every change.
- 5+ years in DevOps, SRE or platform engineering, with at least 3 years running production workloads on AWS
- Hands-on Amazon EKS in production: upgrades, node scaling (Karpenter or Auto Mode), ingress or Gateway API, IRSA or Pod Identity, troubleshooting
- Strong Terraform: multi-environment layout, reusable modules, remote state and locking, safe plan and apply in CI
- CI/CD with Bitbucket Pipelines or GitHub Actions, plus Helm and a GitOps workflow (ArgoCD, Flux or a Helm deploy repo)
- AWS networking and security: VPC design, NAT, VPC endpoints, peering, WAF, IAM, KMS, Secrets Manager, OIDC federation
- Disaster recovery on AWS: cross-region replication for RDS and S3, failover runbooks and DR drills
- Observability: Prometheus, Grafana, Loki or ELK/EFK, and alerting design
- Linux and scripting in Bash and Python
- Has worked in a regulated or security-sensitive domain (fintech, banking, payments) with ISO 27001 or SOC 2 style controls
- Can own a client environment end to end: clear written English and confident in client calls
- Can handle 2 or more projects at once and prioritise without close supervision
NICE TO HAVE
- AWS certifications: Solutions Architect Professional, DevOps Engineer Professional or Security Specialty; CKA or CKS
- Amazon Managed Prometheus/Grafana, ADOT and Grafana Alloy
- Velero backup and restore for Kubernetes
- Security tooling in pipelines: Trivy, tflint, SonarQube, Snyk
- Golang basics, enough to read services and debug builds
- Generative AI on AWS (Amazon Bedrock) or running AI-assisted engineering workflows
- Azure (AKS) experience for multi-cloud projects
Benefits
- International working environment with AI-driven strategic direction.
- 20 days of annual leave – Hybrid working mode.
- Premium healthcare package with BIC and comprehensive annual health check-ups
- Competitive salary & 13th salary bonus
- Lunch allowance to fuel your productivity.
- Engaging company culture with fun activities
- Global collaboration – Work with both Vietnamese and international colleagues.