Cloud Engineer

About the role

Plutus21 is looking for a Cloud Engineer to own deployment, tenant isolation, and platform operations across multiple client environments. You will ensure secure, isolated, and reliable delivery of the platform whether hosted by Plutus21 or in a client’s own cloud.

Key responsibilities

• Package the platform as a containerized deployment unit per client with identical code across environments.
• Build and maintain IaC modules using Terraform or Pulumi, starting with AWS and extensible to other clouds.
• Implement portable stateful components such as PostgreSQL, S3‑compatible storage, OIDC identity, and secrets management.
• Design and test tenant isolation, including sub‑tenant separation within a single client.
• Control data egress at the infrastructure level, allowing only client‑authorized outbound connections.
• Operate hybrid deployments in client‑hosted environments with outbound‑only control‑plane connections.
• Define shared‑responsibility models and SLAs for client‑hosted setups.
• Manage upgrades and releases across many environments without configuration drift.
• Establish baseline security and observability: SSO, audit logging, encryption, monitoring, and alerting.

Required profile

• Proven experience owning production Terraform or Pulumi codebases with reusable modules.
• Hands‑on experience running Kubernetes or equivalent orchestration across multiple environments.
• Deep expertise in a major cloud provider, preferably AWS, with awareness of vendor lock‑in avoidance.
• Experience operating PostgreSQL and object storage in production, including backups and upgrades.
• Strong understanding of tenant isolation, private networking, egress control, and secrets handling.
• Experience with CI/CD pipelines and versioned releases across many environments.
• Excellent written communication for design notes and runbooks.

Required skills

• Terraform
• Pulumi
• Kubernetes
• AWS
• PostgreSQL
• S3‑compatible object storage
• OIDC identity management
• CI/CD
• Git/GitOps
• Policy‑as‑code (optional)