IAC Devops Engineer
Engagement: Build and maintain Development, Stage, and Production for a set of
AI solutions
Role summary
The engineer takes full ownership of
the AWS infrastructure powering these AI solutions. Built using Terraform and
Terragrunt, the platform demands deep hands-on expertise and practical
knowledge.
Responsibilities span the full
stack—including edge routing, identity and access, networking, storage,
asynchronous workflows, and integrated AI/search services. The engineer will
maintain shared, reusable modules across all solutions and manage seamless
environment promotion across development, staging, and production environments.
Key responsibilities
● Design, write, and maintain
Terraform modules and Terragrunt configuration that can be orchestrated across
multiple AWS accounts.
● Build and operate Development,
Stage, and Production from that code.
● Own the shared platform: API
Gateway, CloudFront, WAF, DNS, certificates, IAM, KMS, VPC and endpoints,
Lambda, container services, Step Functions, queues, storage, event rules, and
the generative-AI and search services in use.
● Keep infrastructure in code.
Return any console change to the repository, and keep remote state out of
source control.
● Review a Terraform plan before
every apply, including what will change, where, and how it will be rolled back.
● Build the pipelines that
validate, scan, test, and deploy. A failed check blocks the merge.
● Apply least-privilege IAM and
remove unused roles, broad grants, and placeholder policies.
● Keep infrastructure and
container security scans in the pipeline, with an enforced quality gate.
● Support application teams on
runtime wiring: function and task configuration, environment variables,
secrets, and the image produced by the pipeline.
● Maintain the environments after
release, including alarms, retention, certificate renewal, and drift.
● Version Control &
Branching Strategy: Experience managing
Terraform code in Git using trunk-based development or feature branch
workflows, ensuring all infrastructure changes are tracked and peer-reviewed.
● GitHub Actions & CI/CD
Integration: Hands-on experience building
and maintaining GitHub Actions workflows that automatically run terraform
fmt, terraform validate, security
scans, and terraform plan on every Pull Request.
● Pull Request Plan Reviews: Automatically posting terraform plan output as a
comment on GitHub Pull Requests to facilitate asynchronous code and
infrastructure reviews before merging.
● Branch Protection &
Quality Gates: Enforcing strict branch
protection rules in GitHub where passing automated checks (linting, security,
and clean plan) and requiring at least one peer review are mandatory pre-requisites
to merge into main.
● Module Versioning &
Releases: Utilizing Git tagging and semantic versioning for
shared Terraform modules stored in private registries or repositories to ensure
reproducible and controlled module consumption across environments.
Required qualifications
● HashiCorp Certified: Terraform
Associate (003) certification.
● Hands-on Terraform for
production AWS, including modules, remote state per environment, and
plan-before-apply.
● Hands-on Terragrunt across more
than one AWS account.
● Practical experience building
IAM, networking, Lambda, container services, API Gateway, CloudFront, WAF, DNS,
certificates, and KMS.
● A deployment pipeline the
candidate has written and operated, with validation and deployment and without
a manual apply.
● Experience turning an existing
Terraform codebase into modules that several solutions can share.
● Ability to explain a Terraform
plan line by line and to show the evidence that a change worked.
● Granular Terraform state
management practices, including remote state backends, state locking, targeted
isolation, and state recovery/imports.
● Proficiency in defining and
enforcing Terraform best practices, module design, semantic versioning, and
standardized directory structuring.
● Hands-on experience integrating
IaC linting, automated testing, and security scanning tools (e.g., TFLint,
Checkov, Trivy, or SonarQube) into CI/CD pipelines.
● Experience writing and executing unit and integration tests for
Terraform code using frameworks such as Terratest or native Terraform test
feature.
Preferred qualifications
● Advanced HashiCorp
certifications, such as HashiCorp Certified: Vault Associate/Operations
Professional.
● Amazon Bedrock, or another
managed generative-AI service, and a vector search service.
● Step Functions, queues, and
event-driven processing.
● Container build and registry,
with images pinned by digest or immutable tag.
● Infrastructure and container
scanners tied to a failing quality gate.
● OAuth or enterprise identity
integrated with an API.
● Experience improving inherited
infrastructure rather than only starting from an empty account.
Ways of working
● A second person reviews the
plan and the change. The reviewer is not the author.
● Model-assisted code is a draft
until the author can explain it and a reviewer has approved it.
● A change is complete when the
pull request, the review, and the plan or deployment output are all attached.
Why SA Technologies:
Opportunity to work on real-world projects with leading clients
Learning-focused environment with mentorship from senior engineers
Stable, long-term career growth opportunities
