DevOps Architect - Cloud Infrastructure

Role Summary : The DevOps Architect owns the decisions that outlive any single deployment - the reference architectures, standards, infrastructure BOMs, and CI/CD and security patterns that every PrivaSapien banking and enterprise deployment inherits. Where a Senior DevOps Engineer is accountable for operating one enterprise's estate excellently, the Architect is accountable for designing how PrivaSapien deploys on ANY enterprise's estate so that a new customer is a configuration exercise, not a redesign, directly enabling the product's rapid deployment goals. The role is equally technical and consultative. Internally, it interacts with PrivaSapien Engineering to determine deployment options for each product component and translates them into deployable architectures. Externally, it holds architecture-level discussions with the client's network, cloud, and security teams - owning the architecture diagram that a enterprise's security and infrastructure committees interrogate before approving a deployment. It guides and develops the medium and senior DevOps engineers who operate the resulting estates. Key Responsibilities - Architecture & Design : - Own the PrivaSapien reference architecture for banking and large-enterprise deployments - deployment topology, high-availability and DR patterns, multi-environment (UAT/DC/DR) design, multi-tenancy model, and substrate strategy (AWS/EKS, OpenStack private cloud, bare-metal) - so that all accounts are variants of one coherent architecture rather than bespoke builds. - Interact with PrivaSapien Engineering to determine the deployment options for each product component - the Consent engine, DPR portal, Enterprise Tree service, integration APIs, the data layer (RDS/PostgreSQL, MongoDB, Kafka, Redis), Vault, and GPU inference workloads - and translate those options into concrete, deployable architectures with clear trade-offs. - Build deployable architectures, not diagrams alone - reference Helm/Kustomize structures, IaC module libraries (Terraform), golden cluster configurations, and environment-parity overlays that the account DevOps teams execute directly. - Own the non-functional requirement targets - scalability ceilings, RTO/RPO patterns, latency budgets, throughput models for consent-event volume - and design the architecture to meet them provably. - Make and defend technology-selection and lifecycle decisions - ingress and service-mesh choices, secrets architecture (Vault vs cloud-native), autoscaling strategy, component end-of-life and migration planning - as multi-year bets with documented cost and risk rationale. Key Responsibilities - Infrastructure BOM & Cost Justification : - Propose the infrastructure Bill of Materials for each deployment - compute, memory, storage tiers and IOPS classes, GPU nodes, network, and licensing footprint - sized to the customer's scale and the three-environment (UAT/DC/DR) model. - Justify every BOM line with cost rationale - sizing formulas per customer tier, GPU capacity economics, storage class trade-offs, and the cost implications of HA/DR choices - so that the BOM is defensible to both the enterprise's procurement and PrivaSapien's commercial team. - Design the cost architecture, not just monitor cost - establish the 'standard deployment BOM' and its cost envelope that feeds pre-sales sizing, RFP responses, and the Machine & Software Pre-Requisite Specification. - Produce deployment sizing for RFP and pre-sales - translate a prospect's stated scale and architecture into a credible infrastructure footprint and cost estimate before contract. Key Responsibilities - Security & CI/CD : - Own the security architecture of the deployment within OEM scope - image signing and SBOM strategy, admission-control and Pod Security posture, network segmentation and NetworkPolicy design, secrets architecture, and the evidence model that satisfies a enterprise's security committee and RBI-aligned audit. - Design and mature the CI/CD architecture - multi-environment promotion (UAT - DC - DR), changegate integration with enterprise CAB processes, DevSecOps controls (scanning, signing, IaC and secrets scanning), and GitOps patterns - as a repeatable pipeline standard, not a per-account build. - Define the CI/CD toolchain STANDARD across accounts - orchestrator selection (GitLab CI, Jenkins, GitHub Actions, or AWS CodePipeline/CodeBuild), GitOps engine (ArgoCD/FluxCD), registry (Amazon ECR or Harbor for air-gapped), Helm/Kustomize packaging, and the DevSecOps gate stack (Trivy/Aqua/Prisma scanning, cosign signing, syft/grype SBOM, tfsec/Checkov, gitleaks, SonarQube/OWASP ZAP) - and make toolchain lifecycle decisions (e.g. Jenkins/GitLab migration, ArgoCD adoption) with documented cost/risk rationale. - Understand and design to the enterprise's security constraints - air-gapped or restricted-registry environments, SFTP-scanned image transfer, PIM/bastion access models, data localisation, and encryption posture - so security is architected in, not retrofitted. Key Responsibilities - Client Architecture Engagement : - Hold architecture-level discussions with the client's NETWORK team - connectivity design (Direct Connect/Transit Gateway or on-prem equivalents), DNS and resolver strategy, MTU/overlay considerations, firewall and segmentation requirements - and own the connectivity requirements PrivaSapien hands over. - Hold architecture-level discussions with the client's CLOUD team - landing-zone integration, account and IAM boundary design, service quotas, managed-service adoption under the enterprise's cloud-outsourcing guidelines - as the OEM's technical counterpart. - Hold architecture-level discussions with the client's SECURITY team - presenting and defending the deployment architecture in security review boards, addressing findings at design level, and aligning on the compliance evidence model before deployment begins. - Own the architecture diagram the client's committees interrogate - keep it current, accurate, and defensible, and represent PrivaSapien credibly in win-the-deal and pass-the-review forums. - Understand complex enterprise and large-enterprise architectures - core banking, digital channels, data warehouse, middleware, APIM, and identity layers - well enough to design PrivaSapien's integration into them and to anticipate where deployment friction will arise. Key Responsibilities - Team Leadership, Process & Commercial : - Provide overall technical leadership of the DevOps function and its team leads across accounts - set direction and standards, own the capability roadmap, and hold the team leads accountable for consistent execution against the reference architecture. (Operational line-management and rostering remain with account delivery leads; this role owns the technical and standards authority over them.) - Establish internal engineering processes and drive automation of deployments and CI/CD pipelines for both internal environments and external (customer) deployments - reducing manual effort, deployment time, and error rates, and directly advancing the product's rapid-deployment capability. - Facilitate tooling and infrastructure procurement needed to scale deployment capacity - evaluate and specify the CI/CD, security, and platform tooling, justify it commercially, and support the procurement process with technical requirements and vendor assessment. - Prepare and negotiate technical proposals within the DevOps and deployment domain - solution designs, infrastructure BOMs, and scope/effort estimates - and represent the technical position in client and commercial negotiations. - Helps in scaling up and setting up teams for large number of deployments in various modes. On-premise and remote. - Setup customer infra support team for 9x5 or 24x7 operations for on-premise and remote support mode. Key Responsibilities - Guidance & Governance : - Guide and develop medium and senior DevOps engineers - run design reviews, set