DevOps Engineer Job Description Template (2026)

Full JD (copy-ready)

Paste this into your ATS or careers page. Edit the company name and any bracketed placeholders.

# DevOps Engineer — Job Description

## Role summary
A DevOps Engineer owns the pipeline from commit to production: CI/CD on GitHub Actions, GitLab, CircleCI, or Argo CD; Kubernetes deployments, services, ingress, and HPAs; an observability stack across Prometheus, Grafana, and Datadog; SLOs with error budgets; PagerDuty rotation with written runbooks; and blameless postmortems that produce real guardrails. Focused on automation, reliability, and deployment velocity rather than the underlying cloud platform itself.

## Responsibilities
- Build and maintain CI/CD pipelines on GitHub Actions, GitLab CI, CircleCI, or Jenkins — aim for commit-to-production under 15 minutes on standard services.
- Run GitOps deployments via Argo CD or Flux with progressive delivery (Argo Rollouts, Flagger) and automated rollback on SLO regression.
- Operate Kubernetes 1.28+ workloads: Deployments, Services, Ingress (NGINX, Traefik, or cloud LB), HPAs, PDBs, NetworkPolicies, and cluster upgrades.
- Manage Helm 3 charts and Kustomize overlays with a disciplined release cadence and chart versioning.
- Instrument services with Prometheus metrics, OpenTelemetry traces, and structured logs routed to Loki, Elasticsearch, or Datadog.
- Build Grafana dashboards tied to SLOs (latency, error rate, saturation) and error-budget burn-rate alerts — page on user impact, not CPU spikes.
- Define and track SLOs/SLIs with error budgets; drive release policy when the budget is exhausted.
- Own PagerDuty or Opsgenie rotation with written runbooks; target MTTR under 30 minutes on tier-1 services.
- Run incident response: declare incident, coordinate responders, drive mitigation, write blameless postmortem within 72 hours with action items tracked to completion.
- Manage secrets through HashiCorp Vault, SOPS, sealed-secrets, or External Secrets Operator — zero hardcoded credentials, automated rotation where supported.
- Harden the software supply chain: signed container images (Cosign/Sigstore), SBOM generation (Syft), image scanning (Trivy, Snyk), SLSA compliance targets.
- Run blameless postmortems and ship the process (template, review cadence, action item tracking) — not just the artifact.

## Must-have skills
- 4+ years shipping CI/CD pipelines for production services on GitHub Actions, GitLab CI, CircleCI, Jenkins, or Argo CD.
- Production Kubernetes 1.28+ operation experience: deployments, services, ingress, HPAs, RBAC, troubleshooting pods that crash-loop.
- Strong observability stack fluency: Prometheus + Grafana at minimum; bonus for Datadog, New Relic, or Honeycomb.
- Terraform 1.5+ or Pulumi for the IaC slice DevOps owns (pipeline infra, cluster add-ons, observability stack).
- Written SLOs and error budgets — has run a service by them, not just read the SRE book.
- On-call experience with PagerDuty/Opsgenie and a track record of shipping runbooks.
- Secrets management experience: Vault, SOPS, sealed-secrets, or External Secrets Operator — NOT secrets in env files.
- Strong written English for incident docs, postmortems, and async review.

## Nice-to-have skills
- Progressive delivery: Argo Rollouts, Flagger, LaunchDarkly, or Unleash integration with SLO-driven rollback.
- Supply chain security: Cosign, Sigstore, SLSA, Rekor, or in-toto.
- Service mesh experience: Istio, Linkerd, or Consul Connect.
- Chaos engineering: Chaos Mesh, Litmus, or Gremlin.
- Experience migrating a team from Jenkins to modern CI (GitHub Actions, GitLab).

## Tools and technology
- GitHub Actions / GitLab CI / CircleCI
- Argo CD / Flux (GitOps)
- Kubernetes 1.28+ / Helm 3 / Kustomize
- Terraform 1.5+
- Prometheus / Grafana / Loki
- Datadog / New Relic
- PagerDuty / Opsgenie
- HashiCorp Vault / SOPS / External Secrets
- Cosign / Trivy / Syft
- Argo Rollouts / Flagger

## Reporting structure
Reports to the Head of Engineering, Head of Platform, or SRE Lead. Partners daily with product engineering teams on pipeline and deploy concerns, with Cloud Engineering on the platform / tooling boundary, with Security on supply chain and secrets, and with the on-call rotation across engineering.

## Success metrics (KPIs)
- Deployment frequency: multiple deploys per day per service without incident spike.
- Lead time for changes (commit to production) under 60 minutes on standard services, under 15 minutes on hotfix path.
- Change failure rate under 15%.
- MTTR on tier-1 incidents under 30 minutes from page to mitigation.
- SLO attainment above target on all services owned, with error-budget policy enforced when breached.
- Postmortem cadence: 100% of Sev1/Sev2 incidents have a blameless postmortem published within 72 hours with action items tracked to completion.