• Own end-to-end GitLab CI/CD pipelines for key services, ensuring they build, test, and deploy reliably using K8s runners • Standardize pipeline patterns (templates/components) for multiple tech stacks (.NET, Go, Node, etc.) and environments, emphasizing build reproducibility and security • Implement and maintain multi-stage deployment workflows (dev → lower → upper → stage → prod) with automated checks, approvals, and rollbacks, aligned to our change management practices in Jira • Collaborate with engineering teams to simplify release processes • Operate and evolve AWS EKS clusters in multiple accounts/regions (including GovCloud) using Terraform and shared infra modules (VPC, subnets, security groups, EKS, Route53, ALBs/NLBs, Network Firewall, etc.) • Manage cluster add-ons and platform workloads (e.g., monitoring stack, ingress/proxy, build runners, shared services) via Helm / Helm-based tooling and Git-based workflows • Implement and support infrastructure-as-code for new environments and services (VPCs, EKS clusters, DNS zones, IAM roles, IRSA, Route53 resolver rules, VPC endpoints, etc.) • Deploy and tune observability tooling (e.g., Grafana Alloy, Prometheus-compatible metrics, CloudWatch logs, Loki/Victoria Metrics) to ensure platforms and pipelines are well-instrumented • Define and monitor SLOs/SLAs for critical services and CI/CD components; build alerts using CloudWatch, Grafana, and related tools • Participate in operational reviews, incident response, and post-incident retrospectives, driving reduction of toil via automation, playbooks, and pipeline improvements • Apply our container hardening and FIPS 140-2 guidelines across images and pipelines, including use of Chainguard base images and vault-init-fips entry points where required • Partner with Cloud Platform and Security teams to maintain Network Firewall rules, VPC endpoint policies, and WAF rules that restrict egress/ingress to approved domains and ports • Ensure CI/CD, infra, and release processes support FedRAMP Moderate and related controls (e.g., SA-4(9) functions/ports/services documentation, image provenance in ECR)