Principal DevOps Platform Engineer - AWS

TechGrove is the Centre of Excellence for Banyan Software, based in Chennai, India. It plays a key role in supporting Banyan’s global businesses through technology, security, and software development. TechGrove brings together India’s deep pool of technical talent with Banyan’s long-term approach to growth, creating a trusted, developer-focused environment where people can do their best work.

About the role
star/trac builds flow, a logistics platform for yards, gates and loading docks. It handles truck check-in, self- service terminals (kiosks), slot and dock planning, and real-time monitoring for industrial customers. We are moving flow from a single-tenant setup (WildFly, Oracle, one AWS account per customer, Elastic Beanstalk) to a cloud-native, multi-tenant platform: flow6, a multi-tenant flow API (Spring Boot, JDK 21) that serves many customers from one deployment, with strict tenant isolation flow-dynamic-ui, a configuration-driven frontend where pages, queries and forms are data, not code flow-terminal-service, the backend and configurator for our check-in kiosks An analytics and real-time layer: CDC from Postgres and Oracle into Apache Doris, Kafka (MSK), and live push to the UI much of our engineering runs through AI agents in Claude Code. Each agent has a written contract, hard rules and its own tools. Our infrastructure agents are DiVa, who works inside a workload account (EKS
clusters, Dockerfiles, CI, GitOps deploys, image scans), and Otto, who works across the AWS Organization (accounts, SSO, shared networking, guardrails). They already do real work. They need a human principal who owns them.
This role is that owner. You will run our platform end to end and set up what is still missing, with the agents doing much of the hands-on work under your direction. You will also keep making the agents better: safer, more capable, and more useful to the rest of the team.

What you will do
Own the platform Run our AWS estate: an AWS Organization with shared Networking, Monitoring and Shared Services accounts, plus customer workload accounts. EKS clusters (one per customer and environment, services as
namespaces), ECR, RDS, MSK, Route 53.
Own the deploy path end to end: GitLab CI from one standard template, then image build and scan, then a GitOps repo, then ArgoCD on EKS.
Take new services to QA and then to production. Today that means flow6-mt, flow-dynamic-ui, the auth service and Keycloak.
Make flow6 safe to run as several pods behind one service: per-tenant Quartz schedulers, database locking, cache invalidation across pods, and health and readiness probes.
Set up what is missing
Production secrets: External Secrets Operator with SSM Parameter Store and pod-level IAM roles (IRSA / Pod Identity), in place of hand-made Kubernetes Secrets.
Identity: Keycloak for staff, the existing auth service for customers, and service accounts for system-to- system calls.
Observability across accounts with Grafana, Prometheus and Loki. Alarms that are tuned, not noisy.
The data platform: Apache Doris, CDC pipelines (Postgres logical replication, Oracle LogMiner), Kafka.
Repeatable customer onboarding: account, SSO, VPC, monitoring.
Cost governance and a clear view of what runs where and what it costs.
Lead the infrastructure agents
Own DiVa's and Otto's contracts: their scope, hard rules, process steps and handoffs to the other agents.
Turn repeated manual work into skills: small, deterministic Python tools with read-only doctor / list / plan verbs and gated mutating verbs. Examples are Helm releases, kubectl apply, registry cleanup, and an AWS Organization skill.
Keep and strengthen the safety rails: agents never delete, every change needs an up-front confirm that states cost and blast radius, guard hooks block destructive commands, and nothing goes to main without review.
Check that agent output is correct. Read what they produce, test it against real systems, and fix the contract when an agent is wrong.
Record decisions as Target Architecture Decisions (TADs) and keep the shared memory accurate and sourced.

Be the principal
Make infrastructure decisions on your own and write them down so others can follow.
Work with the architects, backend and frontend developers, QA, and our Cloud Ops lead, who runs the existing customer environments.
Mentor colleagues who are new to Kubernetes or to working with agents.

What you bring
Senior to principal-level experience in DevOps, SRE or platform engineering, including running production systems.
AWS in depth: EKS, IAM (including cross-account roles and SSO / Identity Center), VPC design (including shared VPCs, RAM, peering and endpoints), ECR, RDS, Secrets Manager / SSM.
Kubernetes in production: Helm or Kustomize, GitOps with ArgoCD, add-ons, network setup, rolling deploys.
CI/CD: GitLab CI preferred, including self-hosted runners. Container builds with multi-stage Dockerfiles,
BuildKit and image scanning (Amazon Inspector).
The JVM in containers: Spring Boot services, Gradle / Maven builds, Artifactory.
Databases from an operator's view: Postgres and Oracle; connection pools, migrations (Liquibase), password rotation.
Scripting: Python and Bash, written to be clear, repeatable and safe.
Hands-on work with AI coding agents (Claude Code or similar), or a strong wish to start. You treat an agent as a capable colleague whose work you check, not as a black box.
Safety by default: least privilege, no secrets in repos or images, confirm before you mutate, and an understanding of what an SCP or a delete can break.
Clear written English. German is a strong plus: many of our customers and colleagues work in German.

Nice to have
Multi-tenant SaaS platforms: tenant isolation, per-tenant data sources, "no tenant, no service" designs.
Kafka / MSK, Apache Doris or another OLAP engine, Debezium or other CDC tooling.
Keycloak and OAuth2 / OIDC.
Grafana, Prometheus and Loki across several AWS accounts.
Moving legacy Java EE (WildFly) workloads to containers.
Proxmox / LXC or other on-prem CI infrastructure.
Writing prompts, agent contracts, or evaluation suites for LLM agents.

Your first 90 days
1. Weeks 1–4: Learn the estate and the agents. Run DiVa and Otto on real tasks. Write down where their
contracts are thin or wrong, and fix the first gaps.
2. Weeks 5–8: Finish the QA rollout of the new stack (flow6-mt, flow-dynamic-ui, auth service, Keycloak
hardening). Put production secrets handling (ESO + SSM + IRSA) in place.
3. Weeks 9–12: Agree a production readiness plan for multi-pod flow6 and the first production cluster with
the team. Ship at least one new DiVa skill that removes a manual step from that path.

Recruitment Notice

TechGrove may use artificial intelligence (AI) tools to assist in screening and/or assessing applicants during the recruitment process. All hiring decisions are made by our team. Personal information submitted through your application will be collected and used for recruitment purposes in accordance with applicable privacy laws. Contact us at any time with questions about our process or to request accommodation.

Beware of Recruitment Scams

We have been made aware of individuals fraudulently posing as members of our Talent Acquisition team and extending fake job offers. These scams may involve requests for personal information or payment for equipment. 

Protect yourself by following these steps:

• Verify that all communications from our recruiting team come from an @banyansoftware.com email address.
• Remember, employers will never request payment or banking information during the hiring process.
• If you receive a suspicious message, do not respond — instead, forward it to careers@banyansoftware.com and/or report it to the platform where you received it.

Your safety and security are important to us. Thank you for staying vigilant.