Senior Platform Operations Engineer

Salary Range: 130000 to 150000 (Currency: USD) (Pay period: per-year-salary)

Responsibilities

Simplification & Migration (core mandate)

Plan and execute zero-downtime migrations of services from AKS/containers to VM-based hosting: systemd unit authoring and service supervision (restart policy, resource limits, sandboxing), Apache, HAProxy and/or nginx as reverse proxy and TLS terminator, certificate automation.

Build and own the deployment scripts for the target platform: build → test → archive → ship → symlink-flip → health-check → rollback, scripted in bash.

Preserve two non-negotiable invariants while simplifying everything else: immutable, commit-traceable artifacts and scripted rollback.

Inventory and retire stale infrastructure: dormant deployments, unused DNS records, orphaned firewall rules, unpinned image tags.

Maintain host hygiene for consolidated services: OS patching discipline, runtime vendoring, log rotation, centralized log aggregation.

Familiarity with UptimeKuma, Nagios or similar.

Operate and migrate data stores: PostgreSQL and/or MySQL.

Network and Infrastructure Operations

Operate and troubleshoot workloads during the transition, focusing on the networking layer, load balancing, and core platform services.

Administer the hub network: Azure Firewall rules, VPN gateways, VNet peering, public and private DNS zones and reason about a packet’s full path from public IP to service.

Support the existing release process and network and infrastructure operations until each service is migrated to the new VM-based standard.

Keep the observability stack healthy (OpenTelemetry, ELK, Grafana, uptime and cost monitoring) and carry its essentials forward to the simplified platform.

Coordinate cross-cloud dependencies with AWS: DNS/edge routing, queue consumers, and egress IP allowlists.

L2+ operations support; manage runbooks for external L0, L1 support.

External Integrations & Security

Own the external integrations most at risk during migration: e-commerce and subscription platforms, messaging/notification providers, and clinical/health-data partners — webhook delivery, signature verification, idempotency, and retry semantics.

Raise the security baseline as you consolidate: secrets management, webhook authentication, least-privilege network access, and data-retention hygiene. Findings from an internal review are ready for you to remediate; the instinct to spot and close this class of issue — and not create more — is part of the job.

Qualifications

Required

7+ years operating production Unix/Linux systems, with deep knowledge of systemd, process supervision; Apache, HAProxy

Strong shell plus one scripting language (bash/Python/PHP) with a track record of building deploy and rollback tooling, not just using it.

Demonstrated reverse-engineering ability: taking ownership of an undocumented production service and recovering its real dependencies and failure modes.

Message-queue literacy: Azure Service Bus, SQS, RabbitMQ, or equivalent — ordering, lock/ack semantics, dead-letter handling.

PostgreSQL operations: replicas/clones, connection proxying, network-restricted access, production diagnostics.

Working proficiency with Kubernetes and cloud networking — enough to operate private AKS clusters, an Istio-style ingress layer, and Azure firewall/DNS during the transition. We will onboard you on our specifics; deep specialization is not required.

Migration experience: consolidating or re-platforming production services with zero-downtime cutover and tested rollback.

A demonstrable record of reducing system surface area — services consolidated, infrastructure retired.

Clear written communication for runbooks, migration plans, and cross-functional coordination.

Strongly Preferred

Azure networking at landing-zone depth: hub-spoke VNets, Azure Firewall, Private Link/Private DNS, VPN gateways.

Administration of external-dns, cert-manager, and policy engines such as Kyverno.

ELK and OpenTelemetry pipeline operations.

Webhook-heavy integration experience (e-commerce platforms such as Shopify, subscription billing, marketing/notification platforms, or healthcare data exchanges).

Experience in a regulated or health-data environment: PHI handling, audit trails, least-privilege network design.

Terraform or equivalent IaC for cloud network and compute resources.

Enough AWS to manage cross-cloud seams (Route53, SQS, egress allowlists).

AI minded; proficient with Claude or similar.

What Success Looks Like

First 30 days: Trace and fix a production issue end-to-end (DNS → firewall → ingress → service → database) with guidance; produce a true-dependency inventory for one candidate service.

First 90 days: First service migrated off AKS to the VM/systemd platform with a passing rollback drill; firewall rules, DNS zones, and cluster add-ons documented and reproducible; stale-resource inventory complete and retirement underway.

First 6 months: Migration cadence established with multiple services consolidated; release and rollback drills routine on both platforms; measurable reduction in infrastructure footprint and spend; security-baseline remediations closed.