Senior Cloud Engineer

The short version Most cloud jobs in India are someone else's public cloud. This one is not. The prime focus is Kubernetes on hardware we own: clusters on metal, and tenant clusters those hosts provision. Git is the only path to production. You would own that platform. You will not get an interview on Active Directory and Microsoft 365 alone, and you will not get one on a Kubernetes certificate alone. The person this is written for has already operated both, and wants Kubernetes to be the majority of the work going forward. On-prem Exchange is useful. It is not the job. The stack you will work with. Kubernetes (kubeadm, Cluster API, KubeVirt, hosted control planes, AKS) · Flux, Kustomize, Helm · Harbor · Keycloak · Active Directory, Entra ID, Entra Connect · Microsoft 365, Exchange Online · VMware vSphere/ESXi · Windows Server · Cisco UCS · OpenTofu, Ansible, PowerShell · Prometheus, Grafana · AlmaLinux, Ubuntu · Go, Python, Bash What you would own Cluster lifecycle, both layers. Design, build, upgrade and operate Kubernetes across bare-metal (kubeadm), virtualised (KubeVirt with Cluster API and hosted control planes) and managed cloud (AKS). Own the control plane: etcd backup and restore, certificate rotation, upgrades, RBAC and admission. Operate Cluster API so create, upgrade and retire is a repeatable path, not an artisan one. Workload topology (disruption budgets, anti-affinity, requests and limits) and multi-tenancy that actually holds. Diagnose the hard failures and turn them into runbooks. GitOps as the operating model. Flux, Kustomize, Helm. Desired state lives in Git, not in someone's shell history. Infrastructure as code with OpenTofu or Terraform and Ansible. Automate toil in PowerShell, Bash, and Python or Go. Written blast-radius and a rollback path before production changes. Cluster networking and storage, as a platform consumer. Own service exposure on the clusters: Gateway API and HTTPRoute, ingress, kube-vip and CoreDNS. Use NetworkPolicy, StorageClasses, PVCs, snapshots and the CSI drivers the platform is given. Diagnose whether a fault is the application, the CNI, the CSI or the layer beneath, then work it with the network or storage engineer rather than owning those layers. Deep Cilium and Ceph operations sit with those roles. Active Directory and hybrid identity. Architect and maintain Active Directory: forest and domain design, Group Policy at scale, replication health, trusts, schema changes, and identity hygiene across multi-domain or multi-site environments. Manage hybrid identity through Entra ID and Entra Connect. Own enterprise DNS and DHCP at scale, including AD-integrated DNS, conditional forwarders, scope design, failover and reservations. Join Linux and Windows hosts into the directory where the platform requires it, and integrate Kubernetes access with the identity you already run. Windows Server lifecycle, provisioning, patching, hardening, performance tuning and decommissioning, is part of this, including Windows worker nodes on the clusters. Microsoft 365 and application mail. Exchange Online, hybrid mail flow, and the Microsoft 365 admin surface. Application email enablement: SMTP relay, OAuth 2.0 for mail, SPF, DKIM and DMARC. On-prem Exchange Server is useful if you have it. It is not required. VMware and KubeVirt virtualization. Operate the VMware estate (vSphere/ESXi, vCenter, HA, VM lifecycle) and the boundary with Kubernetes. On the Kubernetes side, KubeVirt is how VM workloads run on the clusters, on KVM. You decide which workload belongs where rather than lifting everything by default. Platform services. Container registry (Harbor or equivalent) and cluster identity (Keycloak or equivalent, federated with Active Directory and Entra ID), or the depth to take both on. Secrets, cert-manager, and image policy as part of how the fleet is run. Kubernetes-native backup and restore. Own backup and disaster recovery for stateful workloads with Velero, Kopia and etcd snapshots, and prove it by restoring, not by reading a green job status. A backup nobody has restored is not a backup. Observability and reliability. Prometheus and Grafana the team actually uses. On-call as a shared rotation, incident command when the platform is the fault, and a root cause analysis afterwards. Capacity planning, and DR you have tested rather than documented. The path from a new server to a production node. Repeatable provisioning, not a manual build: out-of-band management (IPMI, iLO, iDRAC), RAID, SAN/NAS attach, Cisco UCS, firmware, then kubeadm or Cluster API with CNI and CSI validated before the node takes workload. Linux and Windows worker nodes on the same clusters. What the first year looks like Make cluster create, upgrade and retire a GitOps path that someone other than you can run. Establish verified high availability on production: replica counts, host anti-affinity and disruption budgets, applied and checked continuously rather than reconstructed after an outage. Establish provable backup and restore for the Kubernetes platform and its stateful workloads, with independently witnessed evidence. This is a stated company priority, and the platform half of it would be yours. Bring Active Directory, hybrid identity, Microsoft 365 and the VMware estate under the same operating standard as the Kubernetes platform: documented, monitored, and not a single point of knowledge. Remove the single points of knowledge, so no part of the platform depends on one person being reachable. What we need you to have done Three hard requirements. Miss any one and this is not the right role. 1. Production Kubernetes you have operated, including cluster lifecycle. Not a single managed cluster you clicked in a console, and not a certificate you collected to know it. Walk us through a cluster you built or upgraded, a control-plane failure you diagnosed, and how desired state got from Git onto the nodes. 2. Certified Kubernetes Administrator (CKA), or equivalent depth you can demonstrate live. The certificate is the floor. We will still ask you to debug a real failure. CKS or CKAD is a plus. Neither substitutes for (1). 3. Production Active Directory and Microsoft 365 you have operated. Multi-site or multi-domain AD, Entra Connect, Exchange Online and hybrid mail flow. Not an account you were given. On-prem Exchange is not required. Kubernetes, the majority of the role 8+ years in infrastructure engineering. Production Kubernetes is a substantial part of recent work, not a lab, a side project or a certification year. We will not insist on five full years of fleet-scale Kubernetes if the depth is real and current, because this hire also has to have run Windows identity and Microsoft 365. Control-plane depth: etcd operations, cluster upgrades, RBAC and admission, scheduling, and failure diagnosis that is not restart-and-hope. GitOps in production, Flux or ArgoCD with Kustomize and Helm. Git is the only path to production. Cluster API and KubeVirt, or the equivalent: you have provisioned Kubernetes clusters as virtual machines on a management plane, not only consumed AKS or EKS. KVM underneath is expected. Working knowledge of Kubernetes networking and storage as a cluster operator: Services, NetworkPolicy, Ingress or Gateway API, PVCs and StorageClasses. Deep Cilium and Ceph operations sit with the network and storage roles. Linux fundamentals on RHEL/AlmaLinux or Ubuntu: systemd, kernel, the storage and network stacks, performance debugging. Restores you have personally performed for clusters or etcd (Velero, Kopia or equivalent). Not backup jobs you monitored. Prometheus and Grafana in production. Thanos or Loki is a plus. Container registry and cluster identity (Harbor and Keycloak or equivalent), or the depth to take both on. Windows identity and Microsoft 365, you arrive with this Hands-on Active Directory: multi-domain or multi-site, Group Policy at scale, replication, trusts, identity hygiene. Entra ID and Entra Connect. Enterprise DNS and DHCP, including AD-integrated DNS and DHCP failover. Microsoft 365 in production: Exchange Online, hybrid mail flow, and the M365 admin surface. Azure administration fundamentals. Application mail flow: SMTP relay, OAuth 2.0 for mail, SPF / DKIM / DMARC. Windows Server in production, including Windows worker nodes in Kubernetes, not console-only. PowerShell as a working tool, not a line on a CV. OpenTofu or Terraform, Ansible and Bash as well, plus Python or Go. Hardware and virtualization Physical server work: IPMI, iLO, iDRAC, RAID, SAN/NAS attach, Cisco UCS. Automate it rather than repeat it. VMware vSphere/ESXi in production: hosts, vCenter, clusters, VM lifecycle, and how that estate meets Kubernetes. Bachelor's degree in Computer Science, Information Technology, or equivalent practical experience. Clear writing. An ownership mindset. Troubleshooting that proves where the fault is, across identity, mail flow, networking and storage. Nice to have Cilium in production: eBPF datapath, BGP control plane, LB-IPAM, ClusterMesh, network policy and Hubble. The Senior Network Engineer owns this layer. It is useful here, not required. Ceph and CSI operations: Rook or cephadm, OSD and CRUSH, CephFS and RBD, snapshots and storage performance troubleshooting. The Senior Storage Engineer owns this layer. It is useful here, not required. Datacenter networking: VLANs, LACP, BGP, VXLAN, MTU and jumbo frames, enough to work fluently alongside the network team. Experience building and operating bare-metal Kubernetes, not managed cloud only. Azure experience (AKS and hybrid connectivity). AWS or GCP also useful. On-prem Exchange Server 2016/2019/SE: DAGs, hybrid configurations, CU/SU patching and migrations. Useful. Not required. Office 365 is the mail requirement. eDiscovery (standard and/or premium) and Microsoft Purview: data classification, DLP, retention and audit workflows. Useful. Not required. Microsoft 365 administration is the mail and identity requirement. Conditional access, Intune, and broader Entra ID security tooling. Thanos, Loki, Tempo, Flatcar Container Linux, OpenBao. Experience in a FedRAMP, SOC 2, or comparable regulated environment. Red Hat (RHCSA/RHCE), Ceph, Isovalent/Cilium, HashiCorp Vault, or Azure (AZ-104 / AZ-305) certification. Contributions to open-source infrastructure projects. Boundaries Backup responsibility is split across three roles. This is the proposed division. Owner Owns Senior Cloud Engineer (this role) Kubernetes-native stateful backup as part of the platform: Velero, Kopia, etcd snapshots, CSI snapshot plumbing. Senior Storage Engineer The storage and backup platform beneath it: enterprise arrays, Commvault, Ceph capacity, and restore evidence for non-database systems. Manager, Data Platform Database backup, point-in-time recovery and restore, and the evidence standard for data recoverability. How the team works You would join the IT Infrastructure team and work directly with network, storage, security and the application platform teams. On-call is a shared rotation , not a permanent state. Major incidents escalate to the whole team, and we would rather fix the cause than staff the symptom. We expect ownership rather than ticket-taking. If you find something broken outside your area, we would rather you said so than routed it. Based in Noida. That is firm. Relocation is funded. Deep private-cloud Kubernetes people are scarcer in NCR than in Bengaluru, so we expect to hire from elsewhere rather than treat location as a filter after the fact. This role is a step toward platform architecture ownership as the Noida centre grows. Over the years, we’ve discovered that the most effective and successful associates at apexanalytix are people who have a specific combination of values, skills, and behaviors that we call “The apex Way”. Read more about The apex Way - Benefits At apexanalytix we know that our associates are the reason behind our successes. We truly value you as an associate and part of our professional family. Our goal is to offer the very best benefits possible to you and your loved ones. When it comes to benefits, whether for yourself or your family the most important aspect is choice. And we get that. apexanalytix offers competitive benefits for the countries that we serve, in addition to our BeWell@apex initiative that encourages employees’ growth in six key wellness areas: Emotional, Physical, Community, Financial, Social, and Intelligence. With resources such as a strong Mentor Program, Internal Training Portal, plus Education, Tuition, and Certification Assistance, we provide tools for our associates to grow and develop. About Us: At apexanalytix, we’re lifelong innovators! Since the date of our founding nearly four decades ago we’ve been consistently growing, profitable, and delivering the best procure-to-pay solutions to the world. We’re the perfect balance of established company and start-up. You will find a unique home here. And you’ll recognize the names of our clients. Most of them are on The Global 2000. They trust us to give them the latest in controls, audit and analytics software every day. Industry analysts consistently rank us as a top supplier management solution, and you’ll be helping build that reputation. Read more about apexanalytix -