TELL ME ABOUT YOURSELF
Hi, thank you for having me. I am a DevOps engineer focused on AWS, Kubernetes and automation. My education is in finance, so I understand budgets, cost and business value. Later I moved into technology because I love solving problems and automating things.
In my work I build and support cloud infrastructure for development teams. I use Terraform to build reusable modules, so teams can create VPCs, EKS clusters, RDS and S3 in a standard and secure way. For delivery, I build CI/CD pipelines with GitHub Actions and Jenkins, and I use Helm and Argo CD for GitOps on EKS. I add security scanning in pipelines. For monitoring I use Prometheus, Grafana, CloudWatch and Datadog. I join production incidents, find root cause and fix it so it does not repeat.
I have AWS Solutions Architect Associate and Terraform Associate certifications. I am excited about SOA because you are moving to Salesforce, building platform engineering and quality engineering, and focusing on safe delivery and reliability. That is exactly the work I enjoy.
DAY TO DAY RESPONSIBILITIES
Morning I check dashboards in Grafana and Datadog, alerts from the night, failed pipelines and open incidents.
Standup with the team.
Work on Jira tickets, like new environments, databases, S3 buckets or access requests. I do all of it with Terraform, never by hand in the console.
Build and improve CI/CD pipelines, help developers when builds or deployments fail.
Kubernetes work, update Helm charts, manage Argo CD apps, tune CPU and memory, HPA, RBAC, EKS upgrades.
Security work, fix scan findings, rotate secrets, review IAM permissions.
Add dashboards and alerts for new services, clean noisy alerts.
Review Terraform and pipeline pull requests from teammates.
On call and incidents, then root cause analysis.
Write runbooks and documentation so developers can self serve.
Short version: half my time is building and automating, half is supporting developers and keeping production healthy.
MAIN PROJECT STORY
I worked on a platform with more than 100 microservices running on Amazon EKS.
Problem: teams deployed in different ways, some with Jenkins scripts, some with kubectl by hand. Deployments took 40 to 45 minutes, failed often, and it was hard to know what version was in production.
What I did: I built EKS clusters with Terraform modules, VPC, node groups, IAM roles and add ons. I created a standard Helm chart template for all services. I set up Argo CD for GitOps, so merge to Git means automatic deploy. I improved pipelines with Docker layer caching, multi stage builds, dependency caching and parallel tests. I added Trivy image scanning and SonarQube. I set up HPA autoscaling, RBAC, and secrets in AWS Secrets Manager. I set up Prometheus, Grafana and alerts.
Result: deployments went from about 40 minutes to about 12 minutes, around 70 percent faster. Fewer failed deployments, rollback became one git revert, and teams could deploy without waiting for DevOps.
My part versus others: I owned the platform and the delivery path. Developers owned their code, Dockerfiles and their Helm values. QA owned testing. Security reviewed scan results and policies.
TECHNICAL QUESTIONS WITH SHORT ANSWERS
AWS
Q: How do you design a highly available app on AWS?
A: VPC with public and private subnets in at least two or three availability zones. ALB in public subnets, apps in private subnets on EKS or EC2 with auto scaling, RDS Multi AZ, NAT gateway for outbound, Route 53 for DNS, backups and CloudWatch alarms.
Q: Difference between security group and NACL?
A: Security group is on the instance level and is stateful, return traffic is allowed automatically. NACL is on the subnet level and is stateless, you must allow both directions. Security groups have only allow rules, NACL has allow and deny.
Q: Public subnet versus private subnet?
A: Public subnet has a route to the internet gateway. Private subnet has no direct internet access, it goes out through a NAT gateway.
Q: How do you give an app in EKS access to S3 safely?
A: IRSA or EKS Pod Identity. The pod gets an IAM role with least privilege, no access keys in code.
Q: How do you reduce AWS cost?
A: Right size instances, auto scaling, savings plans or reserved instances, spot for non critical workloads, delete unused resources, S3 lifecycle rules, and tags to see cost by team. Show reports with Cost Explorer.
TERRAFORM
Q: What is Terraform state and where do you keep it?
A: State is the file that maps Terraform code to real resources. I keep it in S3 with encryption and versioning, and DynamoDB or S3 native locking so two people cannot change it at the same time.
Q: How do you structure Terraform for many environments?
A: Reusable modules for VPC, EKS, RDS, S3. Separate folders or workspaces for dev, stage and prod, each with its own state and variables. Modules are versioned in Git.
Q: What happens if someone changes a resource by hand in the console?
A: That is drift. terraform plan shows it. I either import the change into code or apply to bring it back. To prevent it, limit console write access and run plan regularly in a pipeline.
Q: How do you run Terraform in CI/CD?
A: On pull request, run fmt, validate, tflint, Checkov or tfsec, and plan, and post the plan in the PR. After approval and merge, run apply. Prod needs manual approval.
Q: terraform import, taint, and lifecycle?
A: Import brings an existing resource into state. Taint, now replace flag, forces recreate. Lifecycle lets me use prevent_destroy, create_before_destroy and ignore_changes.
KUBERNETES
Q: Explain Deployment, Service, Ingress.
A: Deployment manages pods and rolling updates. Service gives a stable IP and DNS for pods. Ingress routes outside HTTP traffic to services, on EKS usually with the AWS Load Balancer Controller.
Q: Pod is in CrashLoopBackOff, what do you do?
A: kubectl describe pod to see events, kubectl logs and logs with previous flag. Common causes are wrong config or secret, app error, failed health probe, or OOMKilled because of low memory limit.
Q: Pod is Pending?
A: Usually not enough CPU or memory on nodes, node selector or taints do not match, or PVC not bound. Check describe pod events, then add nodes or fix requests.
Q: Requests versus limits?
A: Request is what the scheduler reserves. Limit is the maximum. If memory goes over the limit, the pod is OOMKilled. CPU over the limit is throttled.
Q: How does HPA work?
A: It watches metrics like CPU or memory from metrics server, or custom metrics, and adds or removes pods to keep the target. For nodes, Cluster Autoscaler or Karpenter adds nodes.
Q: Liveness versus readiness probe?
A: Readiness says if the pod can get traffic. Liveness says if the pod is stuck and should restart.
Q: How do you manage secrets in Kubernetes?
A: Not plain in Git. I use AWS Secrets Manager with External Secrets Operator or Secrets Store CSI driver, and RBAC to limit who can read them.
Q: How do you upgrade EKS?
A: Read release notes and check deprecated APIs, upgrade in dev first, upgrade control plane, then add ons, then node groups with rolling replacement. Use PodDisruptionBudgets so apps stay up.
CI/CD AND GITOPS
Q: Describe a good pipeline.
A: Build, unit tests, code scan, dependency scan, build Docker image, image scan, push to ECR, update Helm values in Git, Argo CD deploys to dev, then integration and smoke tests, approval, then stage and prod.
Q: Blue green versus canary?
A: Blue green runs two full environments and switches all traffic at once, easy rollback. Canary sends a small percent of traffic to the new version first, like 10 percent, watches metrics, then increases. I can do canary with Argo Rollouts.
Q: What is GitOps?
A: Git is the single source of truth. Argo CD watches the repo and syncs the cluster to match Git. Every change has history and rollback is a git revert.
Q: How do you roll back a bad deployment?
A: With Argo CD, revert the commit or roll back to the previous synced version. With Helm, helm rollback. With canary, stop and abort the rollout.
Q: How do you keep secrets safe in GitHub Actions?
A: GitHub secrets or better, OIDC to assume an AWS role, so no long term AWS keys are stored at all.
Q: Have you used Azure DevOps?
A: My main experience is GitHub Actions and Jenkins. Azure DevOps pipelines use the same ideas, YAML stages, jobs, approvals and service connections, so I can pick it up quickly.
SECURITY AND DEVSECOPS
Q: What is SAST, DAST and SCA?
A: SAST scans source code, like SonarQube. DAST tests the running app from outside, like OWASP ZAP. SCA scans third party libraries for known vulnerabilities, like Snyk or Dependabot.
Q: How do you add security to pipelines without slowing teams?
A: Run fast scans on every PR, deeper scans nightly. Block only critical and high issues, report the rest. Give developers clear results in the PR.
Q: How do you handle IAM?
A: Least privilege, roles not users, SSO with MFA, no root usage, regular access review, and CloudTrail for audit.
Q: SSO and federation?
A: Users log in once with an identity provider like Okta or Azure AD, and AWS or apps trust it through SAML or OIDC. In AWS I use IAM Identity Center connected to the identity provider.
OBSERVABILITY AND SRE
Q: Metrics, logs and traces?
A: Metrics show numbers over time like CPU and error rate. Logs show detailed events. Traces show one request across many services. Together they help find problems fast.
Q: What is SLI, SLO, SLA?
A: SLI is the measurement, like percent of successful requests. SLO is our internal target, like 99.9 percent. SLA is the promise to customers with consequences. Error budget is how much failure we allow, if we use it up we slow down releases and fix reliability.
Q: How do you avoid alert fatigue?
A: Alert on symptoms users feel, like error rate and latency, not every CPU spike. Every alert must have an action and a runbook. Route by severity in PagerDuty or Opsgenie.
Q: What are golden signals?
A: Latency, traffic, errors and saturation.
Q: New Relic or Splunk experience?
A: I used Datadog, Prometheus and Grafana. New Relic is the same idea, APM, metrics, logs and alerts, so I can learn it fast.
Q: What is AIOps and how do you use AI?
A: AIOps uses machine learning to find anomalies, group related alerts and predict problems, like Datadog Watchdog or New Relic AI. Personally I use AI tools like Copilot and Claude to write Terraform and scripts faster, explain errors and summarize logs. I always review the output before using it.
SCRIPTING
Q: What do you automate with Bash or Python?
A: Cleanup of old images and snapshots, health checks, log parsing, reports for cost or unused resources, small tools with boto3 for AWS tasks.
Q: Example Python with boto3?
A: A script that lists EC2 instances without an owner tag or stopped for more than 30 days and sends a report, so we can clean up and save cost.
SALESFORCE
Q: How would you support DevOps for Salesforce?
A: Keep Salesforce metadata in Git, use Salesforce CLI in GitHub Actions to validate and deploy to sandboxes, run Apex tests, then deploy to production with approval. Tools like Copado or Gearset also exist. I am honest that my Salesforce experience is limited, but the CI/CD ideas are the same.
SCENARIO AND TROUBLESHOOTING QUESTIONS
Q: Website is slow in production, what do you do?
A: Check dashboards first, latency, error rate, CPU, memory. Check what changed recently, a deployment or config. Look at traces to find the slow service or database query. Check RDS performance and connections. If a recent deployment caused it, roll back first, then investigate.
Q: Deployment worked in dev but fails in prod?
A: Compare config, secrets, IAM permissions, resource limits, network rules and data. Usually it is a missing secret, permission or different environment variable.
Q: A node in EKS is NotReady?
A: Describe the node, check disk pressure, memory pressure, kubelet logs, network plugin. Cordon and drain it, and let the node group replace it.
Q: Traffic spike during exam registration, how do you prepare?
A: Load test before, set HPA and cluster autoscaling, scale RDS or use read replicas, add caching and CDN with CloudFront, set alerts, and have the team ready on call that day.
Q: Someone deleted a production resource by mistake?
A: Restore from backup or snapshot, recreate with Terraform. Then prevent it with prevent_destroy, limited access, and reviews.
Q: How do you do disaster recovery?
A: Define RTO and RPO with business. Backups with AWS Backup, cross region copies, infrastructure as code so we can rebuild fast, and test the restore regularly.
BEHAVIORAL QUESTIONS
Q: Tell me about a production incident you handled.
A: An app started returning errors after a deployment. I joined the call, saw the error rate in Grafana, and found a new release used a wrong secret name. We rolled back with Argo CD in a few minutes. After, I added a check in the pipeline and wrote root cause analysis so it would not happen again.
Q: Tell me about a time you disagreed with a teammate.
A: A developer wanted direct kubectl access in prod to fix things fast. I explained the risk, and we agreed on GitOps plus a break glass process for emergencies. We both got what we needed, speed and safety.
Q: How do you mentor junior engineers?
A: Pair work, give small real tasks, code reviews with explanation, and good documentation. I let them own something so they grow confidence.
Q: Tell me about a tool or process you introduced.
A: Argo CD and GitOps. I started with a pilot team, showed results, wrote guides, did demos, and helped teams move one by one. Most teams moved within a few months.
Q: How do you handle many priorities?
A: Production issues first, then things blocking other teams, then planned work. I talk with my manager when priorities conflict.
Q: Why are you leaving or why this role?
A: I want a senior role with more ownership, platform engineering and mentoring, and a mission I care about. SOA is a strong organization in Chicago and the Salesforce migration is a great challenge.
GAPS AND HOW TO ANSWER HONESTLY
Azure and Azure DevOps: main experience is AWS, but the concepts are the same, I can learn fast.
New Relic and Splunk: used Datadog and Prometheus, same ideas.
PagerDuty and Opsgenie: say what you used for alerting and on call, same process.
HashiCorp Vault: used AWS Secrets Manager, same purpose.
Okta or Azure AD: understand SSO and federation with SAML and OIDC.
Salesforce: limited, but understand CI/CD for it.
Never say I do not know only. Say I have not used that exact tool, but I used this similar one, and here is how I would approach it.
QUESTIONS TO ASK THEM
What does success look like in the first 90 days?
Is your main cloud AWS, Azure, or both?
Do you use GitHub Actions or Azure DevOps today?
How do you deploy Salesforce changes now?
Are you running Kubernetes today, or mostly VMs?
Do you have SLOs and on call set up, and which tools?
How does DevOps work with the cybersecurity and quality engineering teams?
How are you using AI tools today?
What is the biggest pain point right now?
What are the next steps in the process?
Good luck, you are well prepared.
Top comments (0)