Cloud Engineering·Confirmed live in the last 24 hours·
Full-timeDa Nang, Hải Châu District, Da Nang, Vietnam
About the Job
Requirements
At least 4 years of experience in DevOps, SRE, or platform engineering, including at least 3 years running production workloads on AWS.
Hands-on production experience with Amazon EKS, including upgrades, node scaling with Karpenter or Auto Mode, ingress or Gateway API, IRSA or Pod Identity, and troubleshooting.
Strong Terraform experience, including multi-environment layouts, reusable modules, remote state and locking, and safe plan and apply processes in CI.
Experience with CI/CD using Bitbucket Pipelines or GitHub Actions, plus Helm and a GitOps workflow such as ArgoCD, Flux, or a Helm deploy repository.
AWS networking and security experience, including VPC design, NAT, VPC endpoints, peering, WAF, IAM, KMS, Secrets Manager, and OIDC federation.
AWS disaster recovery experience, including cross-region replication for RDS and S3, failover runbooks, and DR drills.
Observability experience with Prometheus, Grafana, and Loki or ELK/EFK, along with alerting design.
Linux experience and scripting in Bash and Python.
Experience in a regulated or security-sensitive domain such as fintech, banking, or payments, with ISO 27001- or SOC 2-style controls.
Ability to own a client environment end to end, communicate clearly in written English, and participate confidently in client calls.
Ability to handle two or more projects at once and prioritize without close supervision.
Responsibilities
Own AWS infrastructure for development, staging, production, and disaster recovery environments through Terraform, with changes reviewed through pull requests and pipeline plans.
Operate and upgrade EKS clusters, including CPU and GPU sandbox Auto Mode node pools, Gateway API routing, add-ons, and capacity limits.
Maintain Bitbucket Pipelines and the Helm GitOps flow for building application images and promoting releases across environments.
Run and test disaster recovery, including cross-region RDS replication, S3 and ECR replication, Step Functions failover and fail-back; document and verify RPO/RTO targets.
Maintain the security baseline using WAF rules, Security Hub (FSBP and CIS), GuardDuty, Inspector, and least-privilege IAM; triage findings and remediate high- and critical-severity issues.
Operate observability and alerting with Prometheus (AMP), Grafana, Loki, and CloudWatch, routing alerts to team on-call channels.
Onboard white-label tenants by setting up networks, buckets, DNS, certificates, and partner IP allowlists.
Handle incidents and changes according to the client’s change process and write post-incident reports.
Control AWS costs by right-sizing workloads, scaling sandbox pools to zero when idle, and reporting monthly spend trends to the client.
Keep runbooks, architecture pages, and handover documentation current in Confluence.
Attend client meetings, explain technical trade-offs in plain English, and respond to client requests.
Use AI-assisted engineering tools such as Claude Code responsibly for infrastructure-as-code and pipeline work, with human review of every change.
Desired Qualifications
AWS certifications such as Solutions Architect Professional, DevOps Engineer Professional, or Security Specialty; CKA or CKS.
Experience with Amazon Managed Prometheus/Grafana, ADOT, and Grafana Alloy.
Experience with Velero backup and restore for Kubernetes.
Experience with pipeline security tools such as Trivy, tflint, SonarQube, and Snyk.
Golang basics sufficient to read services and debug builds.
Experience with generative AI on AWS (Amazon Bedrock) or AI-assisted engineering workflows.
Azure (AKS) experience for multi-cloud projects.
Job Description
Own the AWS infrastructure for all platform environments (dev, staging, production and DR) through Terraform, with every change going through PR review and a pipeline plan.
Operate and upgrade the EKS clusters, including Auto Mode node pools for CPU and GPU sandboxes, Gateway API routing, add-ons and capacity limits.
Maintain the Bitbucket Pipelines and Helm GitOps flow that builds application images and promotes releases across environments.
Run and test the disaster recovery setup: cross-region RDS replication, S3 and ECR replication, Step Functions failover, and fail-back. Keep RPO/RTO targets documented and verified.
Keep the security baseline green: WAF rules, Security Hub (FSBP, CIS), GuardDuty, Inspector and IAM least privilege. Triage findings and remediate HIGH and CRITICAL ones.
Run observability and alerting with Prometheus (AMP), Grafana, Loki and CloudWatch. Route alerts to the team's on-call channels, not a single mailbox.
Onboard new white-label tenants: network, buckets, DNS, certificates and partner IP allowlists.
Handle incidents and changes using the client's change process, and write short post-incident reports.
Control AWS cost: right-size workloads, scale sandbox pools to zero when idle, and report monthly spend trends to the client.
Keep runbooks, architecture pages and handover docs current in Confluence.
Join client meetings, explain technical trade-offs in plain English, and respond to client request.
Use AI-assisted engineering tools (e.g. Claude Code) responsibly to speed up IaC and pipeline work, with human review on every change.
Qualifications
4+ years in DevOps, SRE or platform engineering, with at least 3 years running production workloads on AWS
Hands-on Amazon EKS in production: upgrades, node scaling (Karpenter or Auto Mode), ingress or Gateway API, IRSA or Pod Identity, troubleshooting
Strong Terraform: multi-environment layout, reusable modules, remote state and locking, safe plan and apply in CI
CI/CD with Bitbucket Pipelines or GitHub Actions, plus Helm and a GitOps workflow (ArgoCD, Flux or a Helm deploy repo)