Senior Cloud Platform Architect – AWS EKS, API Containerization

Job not on LinkedIn

🔥 0 minutes ago

🏄 California – Remote

🏄 California – Remote

⏰ Full Time

🟠 Senior

🔙 Backend Engineer

👻 Ghost score 25%

What it means: how likely this posting is sitting open without active hiring.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

DKSH Portugal, Unipessoal, Lda.

WebsiteLinkedInAll Job Openings

11 - 50 employees

Founded 2014

🍽️ Food & Beverage

📦 Logistics

💼 Consulting

Food & Beverage • Logistics • Consulting

DKSH Portugal, Unipessoal, Lda. is the Portuguese operation of DKSH, a global market‑expansion services provider that helps multinational companies distribute, market and sell specialty chemicals, ingredients (food & beverage, personal care), pharmaceuticals and performance materials. The company offers end‑to‑end B2B services — including distribution, marketing, sales, logistics and regulatory support — to help partners grow their presence in Portugal and connect local markets with global brands.

📋 Description

• Lead containerization of a large-scale API estate for an enterprise financial services client • Turn an approved AWS EKS reference architecture into a secure, repeatable production platform • Build and review Terraform, Helm, Kustomize, Flux, and Istio policy • Implement a multi-AZ EKS Auto Mode foundation and golden path using VPC CNI, Karpenter, KEDA, and reusable Terraform/Helm/Kustomize modules • Document the platform and make it operable by SRE • Establish Flux as the sole production delivery path with continuous reconciliation, signed digest-pinned images, GitLab CI and Artifactory integration, and Flagger SLO-gated canaries • Implement Istio Ambient service mesh, including istiod, istio-cni, ztunnel, opt-in waypoints, SPIFFE workload identity, strict mTLS, AuthorizationPolicy, and default-deny NetworkPolicy • Measure service-mesh latency and overhead • Govern north-south ingress with Tyk Self-Managed and its Operator, including authentication, rate limits, routing, REST-to-gRPC transcoding, and API migration • Implement security controls including Pod Security Standards, Kyverno admission policy, EKS Pod Identity, Secrets Manager/CSI, KMS, cert-manager, image signing, and SBOMs • Build a durable billing and audit capture path using Kinesis, Firehose, S3 Object Lock, and an approved load-tested reliability contract • Establish gRPC/Protobuf as the east-west standard with buf breaking-change checks • Build SLOs, error budgets, and OpenTelemetry-based metrics, logs, and traces into the platform • Create architecture decision records, threat models, and standards • Coach platform, SRE, and application engineers • Represent Opplane in client architecture reviews

🎯 Requirements

• 12+ years in software, infrastructure, or platform engineering • 5+ years of hands-on production Kubernetes on AWS, including EKS architecture, operations, networking, upgrades, scaling, and incident troubleshooting • Proven track record of standing up EKS platforms end to end and containerizing existing API workloads at enterprise scale • Strong Terraform, Helm, and Kustomize skills • Reusable platform-module design • Defensible architecture decisions and cross-team leadership in a regulated environment • Production service mesh ownership, including Istio architecture, policy, rollout, performance, and troubleshooting; Ambient mode especially relevant • Deep GitOps experience with continuous reconciliation, drift management, and environment promotion; ability to implement Flux • Practical Kubernetes and AWS security knowledge, including PSS, policy as code, NetworkPolicy, IAM, Pod Identity, KMS, certificate management, image signing, and SBOMs • API gateway and regulated audit/event-ingestion design experience; ability to own a self-managed gateway • Working knowledge of gRPC, HTTP/2, and Protobuf • Enough Java 21 and Spring Boot familiarity to review the reference runtime pattern • Observability expertise across metrics, logs, traces, SLOs, and rollout analysis with OpenTelemetry • Performance validation at tens of thousands of TPS • Requires US Pacific hours overlap • Requires an escalation rotation during build-out • Requires client background screening • California preferred • Direct Tyk experience strongly preferred • AWS Solutions Architect Professional and CKA/CKS certifications are nice to have

🏖️ Benefits

• Permanent full-time employment • Remote work within the US • California preferred for occasional client-site workshops and readiness reviews • US Pacific hours overlap • Global and multicultural team • Fast-moving, impact-driven startup environment • Ownership over work built • Collaborative, open, curious, and supportive culture