JD: Infra & Platform Architect
Exp.: 10+ years (3+ years in a Principal or Architect-level role)

Work Location: Hyderabad
Work Timing: General Shift
Work Mode: WFO
Notice Period: Immediate

JOB SUMMARY:

The Infrastructure & Platform Architect is the technical authority for every infrastructure, DevOps, and security decision on this platform. You will design and own the end-to-end infrastructure blueprint from multi-cloud IaC to Kubernetes platform engineering, from GitOps delivery pipelines to zero-trust security posture — and lead the three engineers (SRE, DevOps, AppSec) who implement and operate it. This is an IC-led architecture role: you contribute hands-on code, review every significant design decision, and are accountable for the platform meeting its published NFRs

KEY RESPONSIBILITIES:
1. End-to-End Infrastructure Architecture

- Design and own the cloud-agnostic Kubernetes platform architecture across AWS (EKS)
- Define the multi-cloud IaC strategy: Terraform / Terragrunt module hierarchy, remote state topology, per-setting promotion model, and zero-drift enforcement.
- Architect the production Kubernetes clusters: node group strategy (general, GPU A10G for SLM serving, high-memory for graph workloads), autoscaling (Karpenter / Cluster Autoscaler), namespace topology, RBAC model, and network policy design.
- Own the networking architecture: VPC/VNet design, private endpoint strategy, ingress topology (Kong Gateway), and Istio service mesh configuration for STRICT mTLS across all 53 agent workloads.
- Define infrastructure for all specialised platform data stores: Neo4j Enterprise 5.x (3-core causal cluster + read replicas), PostgreSQL 16 (JSONB partitioned agent execution log), Redis 7.2+ Enterprise (hot-path workflow cache), Weaviate 1.25+ (per-app vector collections), and Apache Kafka 3.7+ (500K events/day, 12 partitions).
- Define GPU infrastructure: A10G node pool configuration, NVIDIA device plugin, CUDA driver compatibility, and HPA triggers for vLLM serving pods running Mistral 7B and Phi-3 Mini Q4.

2. DevOps Platform & Delivery Engineering

- Design and govern the CI/CD architecture: GitHub Actions / GitLab CI pipeline templates covering build, lint, unit test, integration test, SAST (Semgrep), container scanning (Trivy), agent eval gates (80% pass rate), staging deploy, and manual production promotion.
- Own the GitOps delivery model: ArgoCD App-of-Apps topology, ApplicationSets per environment, auto-sync staging, manual production gates, and Helm chart standards across all 6 service layers.
- Define canary deployment strategy using Flagger + Istio traffic splitting, with Prometheus- based promotion criteria and automatic rollback.
- Architect the image supply chain: multi-stage Dockerfiles,



Cosign/Notary image signing, ECR / GCR lifecycle policies, and SBOM generation integrated into every release.
- Design the secrets management architecture: HashiCorp Vault HA cluster on Kubernetes, KV v2, database secret engine for PostgreSQL / Neo4j / Weaviate, PKI engine for internal certificates, AppRole and Kubernetes auth methods, and Vault Agent Injector configuration.

3. Platform Observability & SRE Architecture

- Define the observability architecture: Prometheus 2.53 + AlertManager + Grafana 11 stack, OpenTelemetry 1.x distributed tracing (Grafana Tempo in production, Jaeger in dev), and Grafana Loki for structured log aggregation.
- Define the incident response architecture: PagerDuty routing rules, escalation policies, on-call rotation structure across the SRE and DevOps engineers, and the PIR process that feeds improvements back into runbooks and chaos experiments.
- Design the synthetic monitoring and load-testing strategy: Grafana k6 / Checkly critical journey heartbeats, 500-concurrent-workflow load test gates in CI.

4. Platform Security Architecture & Compliance

- Own the zero-trust security architecture: Istio STRICT mTLS across all service-to-service communication, Kong Gateway JWT validation and WAF at the perimeter, OPA/Kyverno admission policies, and PodSecurityAdmission enforcement.
- Define the identity and access architecture: Okta / Azure AD OIDC + SAML integration for the HITL UI and KB Management UI, MFA enforcement for admin roles, IRSA for AWS workload identity, and Workload Identity for GCP.
- Design the DevSecOps pipeline security gates: Semgrep SAST (custom rules for Python, TypeScript, Terraform), Trivy container scanning (zero CRITICAL CVE gate), OWASP ZAP DAST against HITL and KB UI endpoints, and SBOM artefact management.
- Architect the runtime security layer: Falco anomaly detection rules tuned to platform normal behaviour, GuardDuty / Security Hub integration, and CloudTrail / audit log immutability.
- Own the SOC 2 Type II infrastructure controls: audit_log immutability (PostgreSQL append- only, no UPDATE/DELETE), 2-year retention, 90-day HITL decision retention, and the controls matrix mapping platform design to CC6/7/8 trust service criteria.
- Lead LLM-specific threat modelling: prompt injection vectors for the 53-agent system, tool-call abuse paths (Jira, GitLab, XRay APIs),



context manipulation via Weaviate retrieval, and model inference boundary controls for the SLM serving layer.

5. Technical Leadership & Team Development

- Directly lead three engineers: SRE Platform Engineer, DevOps & Cloud Infrastructure Engineer, and Security Engineer (AppSec & Compliance) — setting technical direction, owning their work quality, and growing their capabilities.
- Write and maintain Architecture Decision Records (ADRs) for all significant infrastructure choices; serve as the infrastructure representative on the Architecture Board reviewing ASDLC- ARCH documents.
- Define and enforce infrastructure engineering standards: IaC module quality, runbook completeness, DR procedure fidelity, and on-call readiness across the team.
- Act as the primary escalation path for P1 incidents that exceed the SRE engineer's scope; lead post-incident reviews that produce durable systemic improvements.
- Partner with the six application engineering teams to design self-service infrastructure capabilities — developer experience tooling, internal platform APIs, Backstage service catalogue integration — that reduce platform team as a bottleneck.

Background & Education:

Experience:

- 10+ years of professional experience in infrastructure engineering, platform engineering, or cloud architecture — with at least 3 of those years operating at a principal, staff, or architect level where you made design decisions with platform-wide consequences, not just implemented them.
- Demonstrable experience designing and owning a Kubernetes-based platform at production scale — not administering a cluster that someone else designed. You have made the node pool, networking, and RBAC decisions, written the Terraform modules from scratch, and been accountable for the platform's availability targets.
- Production multi-cloud experience at the architecture level: you have provisioned and operated workloads on at least two cloud providers and you understand where the abstractions hold and where they break. Cloud-agnostic IaC is not a design principle to you — it is something you have actually delivered.
- End-to-end CI/CD and GitOps ownership: you have designed a delivery platform that engineers other than yourself use daily — including the security gates, approval workflows, and rollback procedures — and you have improved it based on post-incident analysis.
- Secrets management architecture experience: you have designed and operated HashiCorp Vault (or an equivalent) in production, including auth method configuration, secret engine design, lease TTL governance, and rotation policy — not just called the API.

Interested candidates can email their updated resume to [email protected]

📌 Infra & Platform Architect (Hyderabad)
🏢 Crew Kraftorz
📍 Hyderabad