Senior Network DevOps Engineer

We are looking for a Senior Network DevOps Engineer to own the network security layer and ingress configuration of SAP's internal SonarQube platform, running on GCP and Kubernetes. This role covers GCP Cloud Armor policy management, DNS and firewall configuration, Ingress NGINX tuning, and abuse prevention, ensuring the service remains available and well-protected for thousands of developers across SAP. The work combines proactive hardening, such as automating Cloud Armor rules and cleaning up redundant network configurations, with reactive investigation, including diagnosing rate-limit false positives and tracing missing client IPs in proxy logs. All changes are validated on a test cluster before being applied to production.

Feel free to work remotely from anywhere across Latvia or connect with colleagues at our Riga office.

• Assess, configure, and automate GCP Cloud Armor security policies for the SonarQube platform
• Investigate and tune GCP rate-based ban rules to prevent false positives affecting legitimate CI/CD traffic
• Audit and remove redundant DNS zone and firewall configurations across GCP projects
• Diagnose and resolve NGINX Ingress configuration issues, including proxy headers, log format, and client IP extraction
• Implement monitoring and alerting for abuse patterns using GCP logs and the SonarQube API
• Modify and maintain Ingress NGINX Helm chart configuration
• Analyze GCP Cloud Logging and Splunk data to identify problematic IPs and traffic patterns
• Validate all network and infrastructure changes on the test cluster before deploying to production
• Document security rules, network configuration decisions, and operational runbooks

• 5+ years of experience in network engineering, DevOps, or cloud infrastructure roles
• Expertise in GCP, including Cloud Armor, WAF rule authoring, rate-based banning, and policy automation
• Proficiency in GCP Cloud Logging, covering log query language, HTTP load balancer, and L4/L7 proxy log analysis
• Knowledge of GCP networking, including DNS zone management, VPC firewall policies, and firewall rule lifecycle
• Familiarity with Ingress NGINX configuration via values.yaml and proxy header handling
• Skills in Kubernetes and Helm
• Competency in Splunk, including log queries, field extraction, and correlation
• Proficiency in English at a B2+ level

Nice to have

• Familiarity with Terraform or OpenTofu
• Knowledge of GCP Cloud Monitoring
• Skills in Bash and jq
• Understanding of GCP HTTP(S) Load Balancer

• Engineering Heritage: Best-in-class experts sharing a culture of engineering excellence and tackling complex engineering challenges for over 30 years.
• Advanced Tech Stack: Innovative projects where you can apply or enhance your expertise in Cloud, Data, AI, and other emerging technologies.
• World-Class Clients: Work closely with 340+ of the Forbes Global 2000 on creating disruptive solutions that make a global impact.
• Professional Growth: Exceptional support for career development with comprehensive resources for upskilling or reskilling in pioneering practices.
• GenAI Community: Strong AI competencies with 600+ experts across 55+ locations driving GenAI-enabled transformation journeys.
• Entrepreneurial Culture: If you're passionate and dedicated to improving business transformation, we provide the support you need to bring your ideas to life.
• Hybrid Setup: The flexibility to work from any location in Latvia, whether it's your home or our office in Riga.
• Other Benefits: Additional vacation and trust days, private health insurance, Employee Stock Purchase Plan and more.