About the role
Testlify runs a multi-tenant talent assessment platform serving customers across four AWS regions (US, EU, Australia, Middle East). Every region carries its own EKS cluster, its own data plane, and its own data- residency obligations. That means the platform is not one environment you can hold in your head — it is four, kept in step by Terraform and GitOps.
You will own that platform end to end: the Terraform that provisions it, the ArgoCD repos that deploy into it, the observability that tells us when it is unhealthy, and the on-call response when it is not. This is a hands-on infrastructure role, not a ticket-queue role. You will be trusted with production and expected to leave it more boring than you found it.
What you will actually work on
- Multi-region Kubernetes. Four production EKS clusters plus staging, node lifecycle on Karpenter,
autoscaling via KEDA and metrics-server, ingress through nginx-ingress and the AWS Load Balancer
Controller.
- GitOps as the single source of truth. All cluster state lives in a Git repo rendered by ArgoCD per region. Live kubectl changes get reverted by self-heal, by design. You will keep that invariant honest and make sure deletions cascade properly.
- Terraform at scale. ~30 in-house modules (VPC, EKS, RDS, DocumentDB, ECS, OpenReplay, Metabase, OTel collectors, Vercel projects) composed into per-region live stacks and executed through Terraform Cloud. You will keep drift near zero and treat unapplied branches as a defect, not a state.
- Secrets and identity. External Secrets Operator against AWS Secrets Manager, IRSA and OIDC federation for passwordless access to MongoDB Atlas and AWS APIs, plus scheduled credential rotation. Getting trust policies and per-environment overrides exactly right is a large part of the job.
- Observability. A regional OpenTelemetry collector fleet relaying into Grafana Cloud, self-hosted
OpenReplay for session replay, and Metabase on EKS + RDS for analytics. You will improve signal,
not add dashboards nobody opens.
- CI/CD. GitHub Actions across ~20 Node.js/TypeScript service repos plus Nuxt and Vue frontends on Vercel— build, test, preview environments, and promotion to staging and production.
- Cost and capacity. Right-sizing nodes, setting resource limits so no workload can starve a kubelet,
managing service quotas, and reporting on spend per region.
- Compliance engineering. SOC 2 / ISO / GDPR controls are tracked in Scrut. Evidence, access reviews, key age, log retention, and data-residency enforcement are platform responsibilities, not paperwork someone else does.
- Incident response. Shared on-call. Write the postmortem, land the durable fix, and add the guardrail that makes the class of failure impossible rather than unlikely.
Our stack
- Cloud: AWS (primary) — us-east-1, eu-west-1, ap-southeast-2, il-central-1; Azure and GCP for legacy and partner-integrated workloads
- Orchestration: Amazon EKS, Karpenter, KEDA, cert-manager, NGINX Ingress
- Infrastructure & Delivery: Terraform, Terraform Cloud, ArgoCD, Helm, GitHub Actions
- Data & Messaging: MongoDB Atlas, Amazon RDS (MySQL/PostgreSQL), DocumentDB, ClickHouse, Redis, BullMQ
- Services & Frontend: Node.js, TypeScript, Nuxt, Vue, Vercel
- Observability: OpenTelemetry, Grafana Cloud, OpenReplay, Metabase
- Operations & Platform Tools: External Secrets Operator, Rundeck, n8n, Scrut
Must have
- 3+ years running production Kubernetes, ideally managed (EKS/GKE/AKS), including debugging node-level problems, not just pod-level ones.
- Strong Terraform: modules, remote state, plan review, and the discipline to never let live infrastructure diverge from code.
- Real depth in at least one major cloud — AWS, Azure, or GCP — covering IAM (roles, trust policies, OIDC/workload identity federation), virtual networking, and at least one managed data service. AWS is where you will spend most of your time, so AWS experience is the strongest signal.
- Comfort with GitOps and Helm, or a clear track record of declarative delivery you can map onto it.
- Scripting in Bash plus Python or TypeScript — enough to automate, not just to glue.
- Linux and container fundamentals: cgroups, resource limits, DNS, TLS, image builds.
- Production on-call experience and the writing habits that make incidents useful afterwards.
Nice to have
- Multi-region or data-residency-constrained architecture.
- Multi-cloud or cross-cloud migration experience across AWS, Azure, or GCP.
- OpenTelemetry pipelines and Grafana Cloud, or equivalent.
- Karpenter or Cluster Autoscaler tuning, and AWS service quota management.
- SOC 2 / ISO 27001 / GDPR evidence and control work.
- Self-hosting sizeable OSS platforms (ClickHouse, OpenReplay, Metabase, ArgoCD).
- Cost optimisation with numbers to show for it.
How we work
- Infrastructure changes land through Git and a plan review. No exceptions for convenience.
- Fix the class of problem, not the instance. Every incident should retire a category of failure.
- Guardrails over rules: resource limits, quotas, and policy checks beat asking people to be careful.
- Write things down. Design docs before large changes, runbooks before handover, postmortems after incidents.
- Small blast radius. Region by region, staging first, reversible where possible.
30-60-90 Plan
- 30 days: Ship a production change through the full path — Terraform plan, GitOps merge, verified rollout. Be on-call shadow. Know every region's topology and where its data lives.
- 60 days: Own one platform domain end to end (observability, secrets and identity, or cluster lifecycle). Close the gaps you find in it.
- 90 days: Lead a cross-region project — a migration, a hardening pass, or a cost reduction — with a written design and a measurable result.
What do we provide @ Testlify?
- An inspiring work environment and focused workspace.
- A performance-driven work culture through collaborative review and feedback.
- Opportunities and guidance to learn new technologies, share knowledge, and grow within the company and sector.
- Exposure to complex & challenging projects within an international context.
- A team of driven and passionate colleagues that strive for top quality.
Benefits
- Health insurance
- Diversity and inclusion
- Learn and grow
- Flexible work hours
Equal opportunities statement
Testlify is deeply committed to creating a workplace and global community where inclusion is not only valued but prioritized. We're proud to be an equal-opportunity employer, seeking to create a welcoming and diverse environment. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, gender identity or expression, family status, marital status, sexual orientation, national origin, genetics, neurodiversity, disability, age, or any other non-merit-based or legally protected grounds.
