[Hiring] Senior DevOps Engineer @CI&T

Role Description

At CI&T, we help large enterprises transform the potential of AI into real business impact with AI Deployment, AI-native execution, and tech-integrated business solutions. You will:

• Co-own a multi-account AWS network foundation: hub and spoke on Transit Gateway, centralized inspection, controlled egress, hybrid connectivity into a client's SD-WAN estate through a third-party vendor.
• Be in the room when the client's cloud architect asks why a subnet is a /25 and not a /24 — and the answer has to be yours.
• Own the network foundation end to end: Transit Gateway with separated inspected and uninspected route tables, VPC design across inspection, egress, ingress, shared services, and workload tiers.
• Define and enforce the routing posture that makes traffic pass a firewall rather than merely sit near one.
• Verify that posture by test, not by reading your own plan.
• Design and implement Transit Gateway Connect over GRE with BGP, two peers for availability, ASNs agreed in advance.
• Extract precise inputs from third-party SD-WAN vendors who are not on your team and do not share your deadline.
• Manage AWS IPAM with a delegated organization administrator, pool hierarchy mapped to accounts, RAM shares to spoke accounts.
• Justify every prefix — "it looked tidy" is not an answer.
• Implement AWS Network Firewall with stateful rule groups, default drop posture, domain allowlisting, and managed threat signatures.
• Be the person who knows whether an application failing to reach the internet is the firewall working correctly.
• Write and maintain Terraform across multiple accounts with per-phase state separation, deployed through GitHub OIDC.
• Implement drift detection, static validation, and a pipeline that a client can inherit.
• Manage log delivery into governance accounts, resource policies, KMS key policies, and service-linked roles.
• Understand that these accept broken configurations silently — and prove delivery by watching a log arrive.
• Write down why: why a prefix is what it is, why an option was rejected, what a deviation is.
• Prevent the next engineer from reversing a deliberate choice because nobody recorded the reasoning.

Qualifications

• Transit Gateway: association vs. propagation (no hedging), appliance mode, and why it exists.
• VPC design: Network Firewall, NAT and egress control, PrivateLink, Route 53 Resolver.
• Hands-on with hub and spoke and centralized inspection — built it, broke it, and fixed it (non-negotiable).
• Ability to describe a routing asymmetry you diagnosed or a firewall you had to prove was in the path.
• Organizations, Control Tower, OUs, SCPs, delegated administrators, RAM.
• Experience inheriting a landing zone someone else deployed.
• Module design, state layout across accounts and phases.
• Read a plan and know before applying whether you are renaming or destroying a resource.
• Site-to-site VPN or Direct Connect, GRE, BGP peering, route advertisement, ASN allocation.
• Default to checking the environment rather than trusting a report — including your own.
• Clear, precise, unhedged prose — a delivery skill, not a nice-to-have.
• Inglês Avançado/Fluente é obrigatório.

Requirements

• AWS Advanced Networking Specialty certification — or the equivalent scar tissue.
• Experience with SD-WAN platforms on AWS (Cisco, Fortinet, Palo Alto) and Transit Gateway Connect.
• Exposure to manufacturing or industrial environments.
• Familiarity with AWS Account Factory for Terraform (AFT).
• Working fluency in both Portuguese and English — client conversations in English; team works in Portuguese.

Benefits

• Health and dental insurance.
• Meal and food allowance.
• Childcare assistance.
• Extended paternity leave.
• Partnership with gyms and health and wellness professionals via Wellhub (Gympass) TotalPass.
• Profit Sharing and Results Participation (PLR).
• Life insurance.
• Continuous learning platform (CI&T University).
• Discount club.
• Free online platform dedicated to physical, mental, and overall well-being.
• Pregnancy and responsible parenting course.
• Partnerships with online learning platforms.
• Language learning platform.
• And many more!

More details about our benefits here: https://ciandt.com/br/pt-br/carreiras