Cloud Engineer (Umhlanga) at Ignition Group

Description

Technical Direction and Design

• Designs and maintains reusable infrastructure-as-code modules across both cloud platforms, within the architecture standards set by the Group Architect.
• Determines the technical approach for assigned work, including environment separation, state management and change review.
• Brings unmanaged cloud resources under code, mostly by replacing them during modernisation rather than retrospective cleanup.

Delivery and Service Operations

• Builds and maintains deployment pipelines with plan-on-pull-request, apply-on-approval, environment gates and required reviewers.
• Uses federated workload identity in place of stored credentials, without exception.
• Maintains the container build and image supply chain: registries, scanning, base image currency.
• Operates the platform services the team builds, including monitoring, capacity, patching, backup verification and recovery testing.
• Participates in incident response, including a support rotation, and turns causes into changes that prevent recurrence rather than detect it sooner.
• Supports migration and modernisation of workloads: containerising, re-hosting or retiring.

Governance, Risk and Compliance

• Implements preventative policy controls that deny genuinely dangerous configurations and audit the rest.
• Enforces naming and mandatory tagging, including the ownership tag without which nothing deploys.
• Implements least-privilege access using managed identities, and removes standing privileged access.
• Remediates security and resilience weaknesses within agreed severity timeframes.

Stakeholder and Business Partnering

• Works with business technology leads to understand requirements and plan modernisation, with priorities set through the Cloud Team Lead.
• Provides the cloud foundation to engineering teams as documented, consumable interfaces so that application templates bind to it without negotiation.
• Supports Information Security with findings validation and compliance evidence.

Continuous Improvement and Innovation

• Removes categories of manual work rather than absorbing them. Operational toil should fall over time, not rise with the size of the estate.
• Consolidates duplicated tooling, pipelines and control planes.
• Builds cost visibility and drives measurable reduction.
• Uses AI assistants as real delivery leverage while remaining accountable for reviewing generated infrastructure code before approval.

People Leadership

Not applicable: individual contributor role. (Cluster removed per template instruction.)

Requirements

• A relevant tertiary qualification is advantageous
• Certifications such as AZ-104, AZ-400, AWS Solutions Architect Associate or CKA are useful supporting evidence, not a substitute for demonstrated work.

Essential

• 3 to 5 years in a cloud engineering, DevOps or platform role on production systems, with both build and operational responsibility.
• Strong Terraform, having authored reusable modules and managed remote state. Not limited to running pipelines someone else wrote.
• Genuine production depth in one major cloud platform, with real ownership of live workloads. The appointment must cover whichever platform the central cloud team does not already hold, confirmed at the point of hiring.
• Working knowledge of a second cloud platform, and evidence of having learned a platform to depth before.
• Production Kubernetes, able to deploy and diagnose workload failures independently.
• Has authored CI/CD pipelines, in any major system.
• Incident response experience, including a support rotation.
• Networking and cloud identity fundamentals: virtual networks, routing, security groups, DNS, TLS, private connectivity, managed identities, role-based access and federated authentication.
• Docker, Linux and scripting in Bash or Python.

Advantageous

• Policy-as-code and infrastructure security scanning Open Telemetry and a modern observability stack  serverless and managed container services · CDN and web application firewall platforms  managed database services  cloud cost management and FinOps  regulated environment experience such as PCI-DSS, POPIA or ISO 27001 formal change, incident and problem management.

SKILLS AND CAPABILITIES

• Infrastructure as code at module level, including state, drift and safe refactoring across environments and platforms.
• Production cloud engineering: owns live workloads and understands service limits, failure modes and cost implications.
• Secure pipeline design with meaningful gates, federated identity and artefact promotion, rather than scripts that deploy.
• Incident diagnosis under pressure: restore first, establish cause second, then change something so it does not recur.
• Network and connectivity diagnosis end to end, across routing, name resolution, security rules and private connectivity.
• Identity and secrets engineering, removing standing access and credentials held in code.
• Critical review of AI-generated infrastructure code, particularly in permission scoping, policy definition and private networking where generated code is characteristically wrong.
• Documentation others actually use.