Devops / platform engineer

Context We run a new kind of platform for charity-driven lottery (player app, web cashier, operator admin) plus a game-integration layer, on GCP/Kubernetes, moving real money in production. We're a startup, and this is a position we haven't had before — you'll own the cloud platform end-to-end and shape how we run it. What you'll own • Infrastructure-as-Code — a multi-project (dev/prod) Terraform estate on GCP: GKE, Cloud SQL (Postgres 17, HA), Secret Manager, Artifact Registry, VPC/Cloud NAT, Workload Identity. • GitOps delivery — ArgoCD + Kustomize (with argocd-image-updater) across environments; safe promotion dev → prod. • Kubernetes — ingress-nginx, cert-manager, external-secrets, HPAs, PodDisruptionBudgets, NetworkPolicies. • Edge & security — Cloudflare DNS, WAF (incl. VPN-gating of internal surfaces), Cloudflare Pages, Origin CA / mTLS. • Observability — the Prometheus/VictoriaMetrics + Loki/VictoriaLogs + Vector + Grafana stack; define SLOs, dashboards, alerting. • CI/CD — GitHub Actions + self-hosted ARC runners; container build/registry. • Production reliability — primary on-call, incident response, capacity, Postgres health, backup/restore/DR. • Secrets & compliance — bring secrets management to maturity, support gaming/fintech audit and least-privilege access. • Ownership & docs — come up to speed on the existing setup, take full ownership, and document it as you go. Must-have • Production Terraform (modules, remote state, multi-env). • Production Kubernetes ops (managed clusters; GKE ideal) + Helm. • GitOps (ArgoCD or Flux) with Kustomize. • A major cloud, GCP preferred (AWS/Azure transferable). • CI/CD pipelines; Docker; Linux; scripting (Bash/Python). • Observability with the Prometheus/Grafana ecosystem + log pipelines. • Networking / TLS / DNS fundamentals; Cloudflare or equivalent CDN/WAF. • Genuine on-call ownership of a production system; incident discipline. • Languages: professional working English required; Russian a strong plus. DevOps / Platform Engineer 2 Nice-to-have • external-secrets + a cloud secret manager; secret rotation. • Cloud SQL / Postgres operations (HA, PITR, tuning). • Regulated-money or iGaming production experience; audit/compliance exposure. • VictoriaMetrics/VictoriaLogs, Vector, Metabase. • Cloudflare Pages, Workload Identity, self-hosted GH runners (ARC). • Coolify (secondary staging path). First 90 days Full context on the Terraform + ArgoCD estate and primary on-call; SLOs + alerting defined; a clean secrets posture; runbooks for deploy, rollback, DB restore, and incident response. Pls send CV