As a Senior DevOps Engineer, you will own NovaLexi's cloud platform end to end — build, deployment, reliability, and the infrastructure side of security — behind an AI-native IP management SaaS serving clients in MENA and the world. You will also run NovaLexi's internal IT (servers, email, identity, endpoints and internal security) and own cloud cost (FinOps) and intelligent operations (AIOps), so the company runs to the same standard as the product. The infrastructure program is already scoped and sequenced; the responsibilities below are what you will deliver in your first year.
What you'll do CI/CD and GitOps. Harden the delivery pipeline on GKE with Jenkins and Argo CD: protected branches, mandatory review, automated test and security gates on every PR, coverage thresholds, gated production deploys with rollback, and Terraform as the single source of truth for GCP resources. Secrets live in Google Secret Manager with a 90-day rotation policy — never in repos. * Multi-AZ deployment and disaster recovery. Run production across availability zones in me-central2, active-active where possible. PostgreSQL streaming replication with automatic failover, continuous WAL archiving to GCS, daily snapshots, weekly off-region archives, and CMEK per tenant on HSM-backed Cloud KMS. Targets: RTO under 4 hours, RPO under 15 minutes — proven in documented DR drills, not asserted on paper. * Security hardening. Cloud Armor WAF with OWASP Top-10 rules, zero-trust network policies between services, a Vertex AI private endpoint in-Kingdom, least-privilege IAM across all service accounts, and vulnerability scanning (Dependabot/Snyk, Trivy, OSV-Scanner) wired into the pipeline. * GCP infrastructure monitoring. Build and run end-to-end monitoring of the GCP estate with Cloud Monitoring and Cloud Logging: health, capacity, and performance dashboards for GKE, Cloud SQL, networking, and Vertex AI; uptime checks and SLO-based alerting routed to on-call; centralized log management with defined retention; and Cloud Audit Logs and Security Command Center findings reviewed and acted on routinely. * KSA regulatory compliance on GCP. Design and operate the GCP environment to meet Saudi requirements end to end, with audit-ready evidence for each: NCA Essential Cybersecurity Controls (ECC), Cloud Cybersecurity Controls (CCC), and Data Cybersecurity Controls (DCC) mapped to GCP controls; the Personal Data Protection Law (PDPL, regulated by SDAIA) enforced through in-Kingdom data residency in me-central2, organization-policy resource-location constraints, CMEK encryption, data classification, and cross-border transfer controls; and SDAIA AI Ethics Principles and NDMO data management standards applied to AI and data workloads. Work with our Security & Compliance lead and KSA-licensed assessors through pre-assessment, remediation, and attestation. * FinOps and cost governance. Own cloud cost visibility and accountability across GCP: billing export to BigQuery, per-tenant and per-environment cost allocation through labels, budgets and anomaly alerts, committed-use discounts and rightsizing, and a monthly cost-to-serve report for leadership. Keep AI spend — Vertex AI inference and GPU workloads — forecast and under control as usage scales. * AIOps and intelligent operations. Use ML-driven operations to cut alert noise and time-to-resolve: anomaly detection on metrics and logs, alert correlation and deduplication, automated runbooks and self-healing for known failure modes, and AI-assisted incident triage and post-incident analysis — all within in-Kingdom data boundaries. * Internal IT infrastructure and support. Corporate IT infrastructure alongside the product platform: servers and internal workloads, corporate email and collaboration (Google Workspace or Microsoft 365 — mail routing, SPF/DKIM/DMARC, retention, and archiving), identity and access (SSO, MFA, joiner–mover–leaver provisioning), device management (MDM), and day-to-day systems support for the team with clear SLAs and documentation. * Internal security solutions.* Select, implement, and operate the internal security stack — endpoint detection and response (EDR), email security and anti-phishing, data loss prevention (DLP), zero-trust remote access, corporate data backup, and patch management — aligned to the same NCA ECC controls as the platform, plus baseline security awareness for staff. * And all responsibilities given by the direct manager.
What we look for
