Devops Architect

Who are we?

At Finastra, we’re a global leader in financial services software, dedicated to expanding access to financial services and shaping what’s next for the industry. Our technology powers mission‑critical solutions across Lending, Payments and Universal Banking, supporting over 7,000 customers, including 80% of the world’s top 50 banks, in more than 110 countries.

We are seeking a highly experienced Senior Platform Engineer (Level 4) with 8+ years of hands-on experience in DevOps, Site Reliability Engineering, and cloud-native platform delivery to join Finastra's Platform & Infrastructure team. This role is the primary implementation and operational owner of the platform capabilities being designed by the Platform DevOps Architect—building and maintaining the self-service IaC provisioning system, GitOps deployment platform, CI/CD pipeline framework, observability stack, and container governance tooling that underpin Finastra's SaaS transformation. The ideal candidate combines deep infrastructure engineering skills with SRE operational discipline: they are as comfortable writing Terraform modules and Kubernetes operators as they are triaging production incidents, authoring post-mortems, and driving reliability improvements. They work autonomously on complex engineering problems, partner closely with the TP5 architect on design validation, and mentor junior platform engineers in cloud-native best practices.

Responsibilities & Deliverables:

Platform Implementation & IaC Delivery

- Build, test, and maintain reusable Terraform modules and Crossplane compositions for compute, networking, storage, identity, and secrets management across Azure, AWS, and GCP

- Implement and iterate the self-service environment provisioning platform—validating IaC modules against policy-as-code guardrails (OPA, Sentinel) and ensuring security compliance at provisioning time

- Author and maintain environment lifecycle automation: cost-tagged resource creation, scheduled teardown workflows, configuration drift detection, and reconciliation processes

- Write infrastructure tests using Terratest or equivalent frameworks, maintaining a high-quality test coverage bar for all IaC modules

- Manage Terraform state backends, workspace strategies, and remote execution configuration in production environments

GitOps & Deployment Platform Operations

- Build and maintain ArgoCD application sets, app-of-apps patterns, and multi-cluster synchronization configurations

- Author and version Helm charts for platform services and development team workloads, enforcing Kubernetes deployment standards (resource requests/limits, security contexts, health probes, PDBs)

- Implement and maintain deployment promotion workflows across dev, staging, and production environments, including automated rollback triggers and canary analysis integrations

- Operate and evolve the internal developer portal (Backstage or equivalent), maintaining integrations with CI/CD systems, secret stores, and environment registries

- Debug and resolve deployment failures across the GitOps platform, providing first-line support to development squads experiencing deployment issues

CI/CD Pipeline Engineering

- Design, build, and maintain shared CI/CD pipeline templates (Azure DevOps, GitHub Actions, or equivalent) that standardize build, test, scan, and publish workflows across Lending product teams

- Integrate security tooling into pipelines as enforcement gates: container image scanning (Trivy, Snyk), SAST/DAST tooling, dependency vulnerability detection, and IaC static analysis (Checkov, tfsec)

- Implement artifact management and promotion workflows: OCI image tagging conventions, Helm chart versioning, and artifact signing via Sigstore/Cosign

- Monitor pipeline health, failure rates, and build performance metrics; drive continuous improvement in pipeline reliability and developer feedback latency

- Partner with development squads to onboard them to shared pipeline templates, resolving integration issues and iterating templates based on team feedback

Observability & SRE Practice

- Instrument platform components and shared services with OpenTelemetry-based distributed tracing, structured logging, and Prometheus metrics

- Build and maintain operational dashboards (Grafana or equivalent) covering platform health, deployment frequency, error rates, and infrastructure utilization

- Define and implement SLO alerting using error budget burn-rate policies; participate in alert threshold tuning and on-call rotation

- Lead incident response for platform-layer issues: triage, mitigation, stakeholder communication, and post-incident review facilitation

- Execute chaos experiments (LitmusChaos or equivalent) to proactively validate platform resilience and identify reliability gaps before they reach production

Kubernetes & Container Platform Operations

- Manage Kubernetes cluster operations: node pool scaling, upgrade coordination, namespace provisioning, RBAC configuration, and network policy enforcement

- Operate container admission control (OPA/Gatekeeper) policy sets, maintaining and updating policies as platform standards evolve

- Monitor container registry health (Harbor, ACR, or equivalent): replication status, image vulnerability reports, and access control audits

- Perform Kubernetes performance tuning: resource quotas, limit ranges, horizontal pod autoscaling, and cluster autoscaler configuration

- Run Falco or equivalent runtime threat detection, reviewing alerts and escalating security events per defined incident runbooks

Collaboration & Mentorship

- Partner daily with the Platform DevOps Architect on implementation validation: providing practical feedback on architectural decisions based on operational experience

- Mentor Level 3 Platform Engineers on cloud-native engineering practices, Kubernetes operations, IaC quality, and SRE discipline

- Participate in architecture design sessions, providing implementation-grounded input on feasibility, complexity, and operational risk

- Contribute to platform documentation: runbooks, operational guides, architecture decision records (ADRs), and onboarding materials for development squads

Required Qualifications

Platform & Infrastructure Engineering

- 8+ years** of professional experience in DevOps, platform engineering, SRE, or cloud infrastructure roles

- Expert-level proficiency in **Terraform**: module design, state management, workspace strategies, remote backends, and test frameworks (Terratest or equivalent)

- Strong hands-on experience with **Kubernetes**: cluster operations, workload configuration, RBAC, network policies, admission control, HPA, and upgrade management

- Demonstrated experience building and operating **GitOps delivery platforms** using ArgoCD, Flux CD, or equivalent tools

- Proficiency in **Helm**: chart authoring, templating patterns, library charts, and Helm release lifecycle management

CI/CD & Developer Tooling

- Hands-on experience building reusable **CI/CD pipeline frameworks** in Azure DevOps, GitHub Actions, GitLab CI, or Jenkins

- Experience integrating security scanning tools (Trivy, Snyk, Checkov, OWASP ZAP) into pipelines as automated enforcement gates

- Familiarity with artifact management: OCI registries, Helm chart repositories, and artifact signing/provenance standards

- Experience operating or contributing to an **Internal Developer Platform** (Backstage or equivalent)

Cloud Platforms

- Hands-on experience with **at least two major cloud providers** (Azure, AWS, or GCP): compute, networking, managed Kubernetes services (AKS, EKS, GKE), IAM, and secrets management

- Understanding of cloud networking: VNets/VPCs, private endpoints, DNS, ingress controllers, and service mesh fundamentals

- Familiarity with FinOps practices: resource tagging, cost attribution, and cloud spend visibility tooling

Observability & Reliability

- Hands-on experience with **OpenTelemetry**, **Prometheus**, and Grafana** for platform instrumentation, metrics collection, and dashboard authoring

- Experience defining and implementing **SLOs and error budget** alerting in production environments

- Demonstrated participation in **on-call rotations** and incident response—triaging, mitigating, and running post-incident reviews

- Familiarity with distributed tracing tools (Jaeger, Tempo, or equivalent) and log aggregation platforms (Loki, ELK, or Splunk)

Security & Compliance

- Practical experience with **OPA/Gatekeeper** admission control policy authoring and enforcement in Kubernetes

- Experience with container image security: scanning, signing (Sigstore/Cosign), and provenance verification

- Understanding of Kubernetes RBAC, network policies, and secrets management (HashiCorp Vault or cloud-native secret stores)

- Familiarity with security compliance standards relevant to financial services (SOC 2, ISO 27001, DORA)

Engineering Practices

- Proficiency in at least one scripting or programming language: **Python, Go, or Bash** — for automation, tooling, and Kubernetes operator or controller development

- Experience with version control workflows (Git), code review practices, and infrastructure-as-code testing standards

- Strong written communication skills: runbooks, ADRs, post-mortems, and technical documentation

Required Skills & Experience

- Certified Kubernetes Administrator (CKA) or Certified Kubernetes Security Specialist (CKS)

- HashiCorp Certified Terraform Associate or Professional

- Cloud platform certifications: AZ-104/AZ-305 (Azure), AWS DevOps Engineer Professional, or GCP Professional DevOps Engineer

- Experience with **service mesh** technologies (Istio, Linkerd) for east-west traffic security and observability

- Hands-on experience with **chaos engineering** tooling (LitmusChaos, Chaos Monkey) and resilience validation programs

- Experience in **financial services or regulated SaaS environments** with familiarity in compliance-as-code approaches

- Contributions to open-source platform or infrastructure tooling projects

We are proud to offer a range of incentives to our employees worldwide. These benefits are available to everyone, regardless of grade, and reflect the values we stand for:

Flexibility: Enjoy unlimited vacation, subject to local regulations and business priorities. Benefit from hybrid working arrangements and inclusive policies such as paid time off for voting, bereavement, and sick leave.

Well‑being: Access confidential one‑to‑one support through our Employee Assistance Program, connect with our network of Wellbeing Champions and Gather Groups, and take part in monthly events and initiatives designed to help you thrive—inside and outside of work.

Health & Financial Security: Medical, life and disability insurance, retirement plans, lifestyle, and other benefits.*

Sustainability: Paid time off for volunteering and donation‑matching opportunities to support causes that matter to you.

Inclusion: Get involved in our inclusion communities, such as Count Me In, Culture@Finastra, Proud@Finastra, Disabilities@Finastra, and Women@Finastra—open to everyone who wants to participate and contribute.

Career Development: Access online learning and accredited courses through our Skills & Career Navigator tool.

Recognition: Take part in our global recognition program, Finastra Celebrates, and share your voice through regular employee surveys that help shape our culture and ways of working.

*Specific benefits may vary by location.

At Finastra, each individual is unique—bringing their own ideas, perspectives, cultural backgrounds, and experiences. We learn from one another, value what makes us different, and create an environment where everyone feels included, supported, and able to be their authentic selves.

Be unique. Be exceptional. Help us make a difference at Finastra.

Applicants for this position need to be located in posted location or their immediate surrounding areas. Due to the requirements of this position, this job posting is not available for, and Finastra will not be considering any applicants who currently reside in New York City or California.