Cloud Engineer

Make cluster create, upgrade and retire a GitOps path that someone other than you can run.

Establish verified high availability on production: replica counts, host anti-affinity and disruption budgets, applied and checked continuously rather than reconstructed after an outage.

Establish provable backup and restore for the Kubernetes platform and its stateful workloads, with independently witnessed evidence. This is a stated company priority, and the platform half of it would be yours.

Bring Active Directory, hybrid identity, Microsoft 365 and the VMware estate under the same operating standard as the Kubernetes platform: documented, monitored, and not a single point of knowledge.

Remove the single points of knowledge, so no part of the platform depends on one person being reachable.

8+ years in infrastructure engineering. Production Kubernetes is a substantial part of recent work, not a lab, a side project or a certification year. We will not insist on five full years of fleet-scale Kubernetes if the depth is real and current, because this hire also has to have run Windows identity and Microsoft 365.

Control-plane depth: etcd operations, cluster upgrades, RBAC and admission, scheduling, and failure diagnosis that is not restart-and-hope.

GitOps in production, Flux or ArgoCD with Kustomize and Helm. Git is the only path to production.

Cluster API and KubeVirt, or the equivalent: you have provisioned Kubernetes clusters as virtual machines on a management plane, not only consumed AKS or EKS. KVM underneath is expected.

Working knowledge of Kubernetes networking and storage as a cluster operator: Services, NetworkPolicy, Ingress or Gateway API, PVCs and StorageClasses. Deep Cilium and Ceph operations sit with the network and storage roles.

Linux fundamentals on RHEL/AlmaLinux or Ubuntu: systemd, kernel, the storage and network stacks, performance debugging.

Restores you have personally performed for clusters or etcd (Velero, Kopia or equivalent). Not backup jobs you monitored.

Prometheus and Grafana in production. Thanos or Loki is a plus.

Container registry and cluster identity (Harbor and Keycloak or equivalent), or the depth to take both on.

Hands-on Active Directory: multi-domain or multi-site, Group Policy at scale, replication, trusts, identity hygiene. Entra ID and Entra Connect. Enterprise DNS and DHCP, including AD-integrated DNS and DHCP failover.

Microsoft 365 in production: Exchange Online, hybrid mail flow, and the M365 admin surface. Azure administration fundamentals.

Application mail flow: SMTP relay, OAuth 2.0 for mail, SPF / DKIM / DMARC.

Windows Server in production, including Windows worker nodes in Kubernetes, not console-only.

PowerShell as a working tool, not a line on a CV. OpenTofu or Terraform, Ansible and Bash as well, plus Python or Go.

Physical server work: IPMI, iLO, iDRAC, RAID, SAN/NAS attach, Cisco UCS. Automate it rather than repeat it.

VMware vSphere/ESXi in production: hosts, vCenter, clusters, VM lifecycle, and how that estate meets Kubernetes.

Bachelor's degree in Computer Science, Information Technology, or equivalent practical experience.

Clear writing. An ownership mindset. Troubleshooting that proves where the fault is, across identity, mail flow, networking and storage.

Cilium in production: eBPF datapath, BGP control plane, LB-IPAM, ClusterMesh, network policy and Hubble. The Senior Network Engineer owns this layer. It is useful here, not required.

Ceph and CSI operations: Rook or cephadm, OSD and CRUSH, CephFS and RBD, snapshots and storage performance troubleshooting. The Senior Storage Engineer owns this layer. It is useful here, not required.

Datacenter networking: VLANs, LACP, BGP, VXLAN, MTU and jumbo frames, enough to work fluently alongside the network team.

Experience building and operating bare-metal Kubernetes, not managed cloud only.

Azure experience (AKS and hybrid connectivity). AWS or GCP also useful.

On-prem Exchange Server 2016/2019/SE: DAGs, hybrid configurations, CU/SU patching and migrations. Useful. Not required. Office 365 is the mail requirement.

eDiscovery (standard and/or premium) and Microsoft Purview: data classification, DLP, retention and audit workflows. Useful. Not required. Microsoft 365 administration is the mail and identity requirement.

Conditional access, Intune, and broader Entra ID security tooling.

Thanos, Loki, Tempo, Flatcar Container Linux, OpenBao.

Experience in a FedRAMP, SOC 2, or comparable regulated environment.

Red Hat (RHCSA/RHCE), Ceph, Isovalent/Cilium, HashiCorp Vault, or Azure (AZ-104 / AZ-305) certification.

Contributions to open-source infrastructure projects.

Backup responsibility is split across three roles. This is the proposed division.

Owner

Owns

(this role)

Kubernetes-native stateful backup as part of the platform: Velero, Kopia, etcd snapshots, CSI snapshot plumbing.

The storage and backup platform beneath it: enterprise arrays, Commvault, Ceph capacity, and restore evidence for non-database systems.

Database backup, point-in-time recovery and restore, and the evidence standard for data recoverability.

You would join the IT Infrastructure team and work directly with network, storage, security and the application platform teams.

On-call is a shared rotation , not a permanent state. Major incidents escalate to the whole team, and we would rather fix the cause than staff the symptom.

We expect ownership rather than ticket-taking. If you find something broken outside your area, we would rather you said so than routed it.

Based in Noida. That is firm. Relocation is funded. Deep private-cloud Kubernetes people are scarcer in NCR than in Bengaluru, so we expect to hire from elsewhere rather than treat location as a filter after the fact.

This role is a step toward platform architecture ownership as the Noida centre grows.

Over the years, we’ve discovered that the most effective and successful associates at apexanalytix are people who have a specific combination of values, skills, and behaviors that we call “The apex Way”. Read more about The apex Way - https://www.apexanalytix.com/careers/

At apexanalytix, we’re lifelong innovators! Since the date of our founding nearly four decades ago we’ve been consistently growing, profitable, and delivering the best procure-to-pay solutions to the world. We’re the perfect balance of established company and start-up. You will find a unique home here.

And you’ll recognize the names of our clients. Most of them are on The Global 2000. They trust us to give them the latest in controls, audit and analytics software every day. Industry analysts consistently rank us as a top supplier management solution, and you’ll be helping build that reputation.

Read more about apexanalytix - https://www.apexanalytix.com/about/