Senior DevOps Engineer AI Services

About Piano  

Piano’s Digital Revenue Optimization solution helps digital services grow revenue by better understanding and influencing their customers’ behavior. Piano unifies analytics, segmentation, and commercial personalization in one AI-driven application, enabling sites and apps to efficiently maximize the value of every user visit. Headquartered in Amsterdam with offices in the Americas, Europe, and Asia-Pacific, Piano serves a global client base including the BBC, Deutsche Telekom, Nikkei, AXA and the Wall Street Journal. For more information, visit piano.io.  

The role

This is a DevOps role in the AI department that runs the full delivery path of Piano's AI services, from the managed laptop software deployments and the AWS network edge to the Kubernetes cluster and the CI runner.
You will be an engineer on the team who operates across AWS networking, an MDM-managed fleet, AWS infrastructure as code, and GitOps-delivered Kubernetes, all at once. Every change you ship is reversible, reviewed and measured.

What you will do

Delivery pipeline

• CI/CD and release engineering. Own every pipeline for AI Services in GitLab CI. Run the runner strategy, OCI layer caching and build cost. Ship 100+ production releases a year with no stability regressions.
• GitOps and Kubernetes. Run the EKS clusters through Helm and ArgoCD with auto-sync to production. Own drift, rollbacks and half-applied syncs.
• Infrastructure as code. Manage AWS (VPC, ALB, security groups, WAF, IAM, OIDC, EFS) in Terraform, deployed through CI pipelines you design and own. Every change ships with its revert command.

Devices, network and identity

• Endpoint fleet delivery. Design the tooling and infrastructure that bring AI Services to end-user devices: policy helper binaries, managed settings and configuration profiles, rolled out via MDM to hundreds of Mac, Windows and Linux machines and to container environments. Own versioning, staged rollout and rollback across the fleet.
• Network edge. Own the path from office and VPN to AWS: corporate egress PoPs, ALB/SG allowlists at quota limits, WAF scopes, TLS. Troubleshoot from the client's egress through VPC routing to the load balancer.
• Identity plumbing. Operate Entra ID app registrations, OIDC trust for CI and the rotation of JWTs, keys and service credentials, without outages over weekends.

Operations, security and cost

• On-call and SLA incident response. Join the platform on-call rotation. Triage, mitigate and resolve production incidents within SLA, keep stakeholders informed and lead the post-incident review.
• Security operations. Run CVE exposure scans across all clusters, remediate audit findings at CVSS 8.5+ and prove closure.
• Telemetry and cost plumbing. Run the OTLP, ClickHouse and Grafana pipelines that report AI usage and spend per user to finance.

What this role requires

All of the following are required to fulfil the role due to the included ownership of production services. Candidates must show evidence of working experiences.

• AWS networking: designed and operated VPCs, subnets and routing, ALBs, security-group allowlists and WAF (regional and CloudFront scope), with multi-AZ high availability.
• Endpoint fleet: built traceable, easy-to-troubleshoot infrastructure that distributes software to every end-user device through Microsoft Intune.
• Cloud IaC: Terraform on AWS, including IAM, OIDC trust, EKS and EFS.
• GitOps Kubernetes: Helm and ArgoCD in production, with automated sync to production.
• CI/CD optimisation: a proven record of making CI/CD faster and leaner for monolithic codebases, which our AI Services run on.
• Release volume: owned a platform that ships hundreds of releases and deployments a year, the pace AI work now demands.
• On-call: served on a production on-call rotation and resolved incidents within contractual SLA targets, including post-incident reviews.
• Security remediation: tracked operational security vulnerabilities and mitigated them through to closure.
• Scaling strategies: deep understanding of the Kubernetes Horizontal Pod Autoscaler (HPA) and of designing autoscaling systems.
• End-to-end ownership: owned outcomes from start to finish while keeping stakeholders, engineering teams and platform users informed throughout.

What this role is not

• Not a single-layer specialist role. The work spans network, endpoint, identity, pipeline and cluster, all at once.
• Not a steady-state operations role. AI Services ship 100+ production releases a year, and the delivery path moves with them.

Why this role matters

The role is essential for the company's productivity, because AI tooling breaks at the layers no single specialist owns: network, endpoint, identity, pipeline and cluster. This role spans all of them, at the pace AI work now demands.