What you will do

• Design and evolve secure AWS environments for client products.
• Build reusable Terraform modules and maintain safe planning, review, remote-state, and drift workflows.
• Package services with Docker and operate them on ECS/Fargate behind ALBs, with images stored in ECR.
• Operate RDS with appropriate backup, upgrade, failover, observability, and recovery procedures.
• Design VPC boundaries, routing, security groups, IAM roles, workforce SSO, and secrets management with least privilege.
• Build GitHub Actions pipelines using OIDC, environment approvals, immutable artefacts, and reliable rollback.
• Establish CloudWatch logs, metrics, dashboards, alarms, and actionable runbooks.
• Improve reliability, security, and AWS cost without introducing unnecessary platform complexity.
• Explain infrastructure trade-offs to engineers and clients and document decisions clearly.
• Participate in production support under explicitly agreed engagement terms; no unstated 24/7 availability is assumed.

Required experience

• 5+ years in DevOps, platform engineering, cloud engineering, or SRE, including ownership of production AWS systems.
• Strong Terraform experience including reusable modules, remote state, review workflows, drift, and failed-change recovery.
• Production experience with Docker and ECS/Fargate.
• Strong AWS networking and security fundamentals across VPC, ALB, IAM, SSO or federation, and secrets.
• Experience operating relational databases on RDS and designing backup and recovery procedures.
• Ability to build secure CI/CD with GitHub Actions and short-lived AWS credentials through OIDC.
• Practical observability and incident-response experience using CloudWatch or equivalent tools.
• Strong written and spoken English for engineering and client communication.

Useful, not required

• AWS Organizations, Control Tower, multi-account landing zones, or IAM Identity Center.
• Blue/green ECS deployments, OpenTelemetry, or practical FinOps.
• Bash, Python, or TypeScript for operational tooling.
• EKS or Kubernetes for client engagements where Fargate is not appropriate.
• Previous consultancy, outsourcing, or direct client-facing delivery.

What we offer

• Full-remote work with a flexible schedule outside agreed client and team overlap.
• Full-time independent-contractor engagement.
• 14 paid vacation days and 7 paid sick days per year.
• Official public holidays in your country of residence in addition to the paid days above.
• Work from your own laptop; EthBerry provides the project accounts and paid software licences required for the engagement.
• Compensation agreed individually based on relevant experience.
• Authority to reject unsafe access practices, including shared accounts and long-lived cloud credentials.
• No assumed 24/7 availability; any on-call scope and response expectations are agreed separately for the engagement.
• The contract does not include health insurance, company hardware, or office-based benefits.

Hiring process

1. Application review.
2. HR screening — 30 minutes.
3. Technical interview — 75 minutes. We discuss one production platform, one incident, one infrastructure decision, and the operational trade-offs involved.
4. Unpaid take-home assignment — strictly capped at 4–6 hours. Produce a written design for a NestJS API on ECS/Fargate with Terraform and GitHub Actions OIDC, including RDS, IAM boundaries, secrets, deployment and rollback, observability, backups, reliability risks, and one cost trade-off. No AWS account, real deployment, or candidate-funded resource is required.
5. Assignment review — 75 minutes. You walk through the design and adapt it to one changed client requirement.
6. Final cultural-fit interview — 30 minutes.

AI tools are allowed. Their use must be disclosed briefly, and you must be able to explain and defend every submitted decision. The assignment is not used in production.