These skills do not affect the main grade but show the breadth of your profile.
AI Coding Assistants
▼
Uses ChatGPT and Claude for generating Terraform, Ansible and Dockerfile templates. Formulates queries for finding solutions to typical infrastructure tasks and debugging configurations.
Applies AI assistants for optimizing infrastructure configurations, analyzing cost reports and troubleshooting. Creates prompts for generating IaC modules following best practices and compliance requirements.
Integrates AI tools into infrastructure workflow for automating IaC code review and incident report analysis. Creates specialized prompts for capacity planning and architecture decision records.
Establishes AI usage standards for the infrastructure team, including AI recommendation verification for production changes. Defines AI trust boundaries for infrastructure decisions of varying criticality levels.
Uses Cursor IDE for editing infrastructure files: Terraform, YAML, Ansible with AI suggestions. Applies basic search and navigation in IaC code projects within the working environment.
Configures Cursor IDE for infrastructure development with extensions for Terraform, Kubernetes and Ansible. Uses AI features for IaC module generation and infrastructure configuration refactoring.
Optimizes Cursor IDE for infrastructure workflow with custom prompts for IaC review and compliance checks. Integrates IDE with remote state and plan previews for safe infrastructure work.
Standardizes Cursor IDE configuration for the infrastructure team with templates, snippets and extensions. Defines best practices for AI usage with infrastructure code considering security.
Uses GitHub Copilot for accelerating infrastructure code writing: auto-completion of Terraform resources, generating bash scripts for automation, suggestions for Ansible YAML configurations. Verifies AI suggestions for cloud resource parameter correctness and configuration security.
Effectively uses Copilot for infrastructure tasks: generating Terraform modules from comments, creating Ansible playbooks from descriptions, auto-completing CI/CD pipelines. Uses Copilot Chat for explaining complex networking configurations and debugging Kubernetes manifests, critically evaluating suggestions.
Applies AI tools for complex infrastructure tasks: generating boilerplate for Terraform providers, refactoring Ansible roles, creating unit tests for IaC through Terratest. Knows Copilot limitations for HCL/YAML and adjusts prompts considering cloud API specifics and network configurations.
Defines AI assistant usage standards for the infrastructure team: guidelines for Copilot with IaC code, review rules for AI-generated Terraform modules on security compliance. Implements custom instructions for infrastructure context and trains team on effective prompt patterns for DevOps tasks.
Alerting & On-Call
▼
Understands the difference between SLI, SLO and SLA in infrastructure context: SLI as specific metrics (uptime, latency p99, error rate), SLO as target values, SLA as contractual obligations. Can read SLO dashboards, understands error budget concept and knows how infrastructure issues affect SLI.
Configures SLI/SLO monitoring for infrastructure services: defining key SLIs (availability, latency, throughput), implementing SLOs through Prometheus recording rules. Configures burn rate alerts for early warning, creates SLO dashboards with error budget tracking and sets up multi-window alerting.
Designs SLO framework for infrastructure platform: cascading SLOs from infrastructure to services, composite SLIs for complex systems, automated error budget calculation. Implements SLO-as-code through Sloth or OpenSLO, configures automated incident creation on breach and integrates SLO with capacity planning.
Defines SLO standards for all infrastructure: standard SLIs for each component class (compute, storage, network, DB), SLO negotiation process with teams. Implements SLO-driven prioritization for engineering work, reviews team SLOs and coordinates error budget policy with product management.
Algorithms & Data Structures
▼
Understands the fundamentals of Algorithms & Complexity at a basic level. Applies simple concepts in work tasks using HCL/Python. Follows recommendations from senior developers when solving problems.
Independently applies algorithmic thinking in infrastructure: evaluates resource allocation algorithms, understands network routing optimization, selects provisioning strategies considering dependency ordering. Analyzes complexity of automation workflows and infrastructure scaling operations.
Applies algorithmic thinking to infrastructure management: load balancing algorithms for traffic distribution, capacity planning algorithms for resource forecasting, network routing optimization algorithms. Designs efficient provisioning algorithms for infrastructure automation with dependency resolution.
Reviews algorithmic solutions in infrastructure tools: analyzing provisioning script complexity, optimizing service dependency graph traversal. Evaluates deployment planning and container placement algorithms, implements automation performance standards for fleets of hundreds of servers.
Understands the fundamentals of Data Structures at a basic level. Applies simple concepts in work tasks using HCL/Python. Follows recommendations from senior developers when solving problems.
Independently selects appropriate data structures for infrastructure management: inventory data models, configuration hierarchies for host/service management, network topology representations. Understands trade-offs between flat vs hierarchical configuration structures for automation.
Selects optimal data structures for infrastructure management: graph structures for network topology modeling, tree structures for DNS and LDAP hierarchies, time-series data models for capacity planning. Optimizes configuration data structures for rapid provisioning and rollback. Designs efficient data models for infrastructure asset tracking and dependency mapping.
Standardizes infrastructure data modeling approaches: host inventory files, service YAML configs, DNS record trees. Reviews data structure choices in IaC modules — Terraform resource mappings, nested Ansible variables, Helm chart configuration hierarchies.
API Management
▼
Reads and understands API documentation of cloud providers and infrastructure tools. Documents simple automation scripts with parameter descriptions and launch examples.
Creates documentation for infrastructure modules: describing Terraform inputs/outputs, Ansible variables. Documents internal platform service APIs with usage examples for DevOps teams.
Develops documentation standards for infrastructure platform: runbooks, architecture decision records, API guides. Creates self-service catalog of infrastructure modules with interactive documentation.
Defines infrastructure documentation strategy for different audiences: developers, ops, security. Organizes documentation-as-code process with auto-generation from Terraform and Ansible.
Application Security
▼
Knows basic OWASP Top 10 categories in infrastructure context: injection attacks through config templates, sensitive data exposure in logs, server misconfiguration. Applies security checklists when configuring nginx/Apache web servers and understands security headers.
Applies OWASP recommendations when configuring infrastructure: WAF rule configuration in CloudFront/Cloudflare, web server hardening per CIS benchmarks, CSP and HSTS header configuration. Automates security scanning of infrastructure endpoints through OWASP ZAP in CI pipelines.
Designs infrastructure protection against OWASP vulnerabilities: multi-layer WAF with custom rules, rate limiting at ALB and nginx level, SSRF protection through network segmentation. Implements automatic DAST scanning for infrastructure services and configures ModSecurity with OWASP Core Rule Set.
Defines application security standards at infrastructure level: WAF policies for all public endpoints, security header standards, vulnerability response process. Reviews team security configurations and implements continuous security testing in infrastructure pipelines.
Knows basic secure coding principles: input validation, secrets management. Applies these principles when writing infrastructure scripts and never hardcodes credentials.
Implements secure secrets management through Vault and AWS Secrets Manager in infrastructure code. Configures encryption at rest and in transit for all infrastructure components and data.
Designs security-hardened infrastructure with least privilege, defense in depth and zero trust principles. Implements automatic IaC vulnerability scanning with tfsec, checkov and sentinel policies.
Defines security baseline for organizational infrastructure with enforcement through policy-as-code. Designs security guardrails for self-service platform, preventing insecure configurations by default.
Caching
▼
Uses Redis at a basic level in Terraform/Pulumi. Performs simple tasks using established templates. Understands basic concepts and follows team practices.
Independently implements tasks with Redis in Terraform/Pulumi. Understands internals and optimizes performance. Writes tests with Terratest.
Manages Redis infrastructure: configuring Sentinel and Redis Cluster, memory optimization through eviction policies, operation latency monitoring. Automates Redis deployment through Ansible/Terraform, configures data persistence and memory exhaustion alerts.
Designs Redis as a managed platform service: cluster deployment standards, backup policies, sharding strategies. Defines SLO for Redis infrastructure, implements self-service instance provisioning and ensures monitoring through Prometheus exporters.
CI/CD
▼
Understands CI/CD concepts and basic GitHub Actions workflow syntax. Can run linters and simple infrastructure code checks in pipeline on each pull request.
Configures GitHub Actions for automatic Terraform module testing, Ansible playbook validation. Implements multi-stage pipelines with plan, apply and post-deploy verification for infrastructure changes.
Designs advanced CI/CD pipelines for infrastructure with matrix builds for multi-cloud testing. Implements reusable workflows and composite actions for standardizing infrastructure deployments.
Defines CI/CD standards for organizational infrastructure changes with approval workflows and environment protection. Designs GitOps processes with automatic reconciliation and rollback for infrastructure.
Clean Code & Refactoring
▼
Understands the fundamentals of Code Quality & Refactoring at a basic level. Applies simple concepts in work tasks using HCL/Python. Follows recommendations from senior developers when solving problems.
Independently applies code quality practices in infrastructure automation. Writes clean Ansible playbooks and Terraform modules with proper variable scoping. Understands trade-offs between infrastructure abstraction and operational transparency. Reviews provisioning code for idempotency, rollback safety, and documentation completeness.
Designs code quality standards for infrastructure automation: Ansible playbook structure, Pulumi/Terraform module conventions, infrastructure testing frameworks. Refactors complex provisioning scripts into declarative, idempotent modules. Establishes review practices for blast radius minimization and rollback safety.
Implements infrastructure code quality practices: tflint and checkov for Terraform, ansible-lint for playbooks, shellcheck for bash scripts. Configures CI pipelines with automatic IaC validation, defines code review standards for infrastructure modules and merge policies.
Cloud Providers
▼
Works with basic AWS services as an infrastructure engineer: EC2 for virtual machines, S3 for storage, VPC for basic networking. Uses AWS CLI for routine operations, understands IAM roles and policies, can view CloudWatch metrics and logs for diagnostics.
Manages AWS infrastructure through IaC: designing VPCs with public/private subnets, configuring ALB/NLB, managing EKS clusters. Configures RDS with Multi-AZ, sets up CloudWatch alarms and SNS notifications, uses Systems Manager for EC2 instance fleet management.
Designs production-grade AWS architecture: multi-AZ and multi-region deployment, Transit Gateway for network connectivity, Organization with SCPs for multi-account strategy. Optimizes costs through Reserved Instances and Savings Plans, configures AWS Config for compliance and GuardDuty for security monitoring.
Defines AWS infrastructure standards for the organization: landing zone architecture, account vending through Control Tower, tagging standards for FinOps. Reviews team AWS architectures against Well-Architected Framework, implements self-service through Service Catalog and defines SLO for AWS services.
Code Review
▼
Participates in infrastructure code reviews as both reviewer and author: checks Terraform configurations for basic errors, reads senior engineers' comments for learning. Can describe changes in PRs (which resources are created/modified) and attaches terraform plan output for clarity.
Conducts quality code reviews for IaC: reviewing Terraform modules for security best practices, validating Ansible playbooks for idempotency, analyzing Kubernetes manifests for resource limits. Pays attention to drift risk, checks backward compatibility of changes and evaluates modification blast radius.
Conducts architectural reviews of infrastructure code: evaluating Terraform module design, analyzing networking topology changes, verifying DR capability of configurations. Automates review through Atlantis/Spacelift for terraform plan in PRs, implements automated policy checks and mentors junior engineers through constructive feedback.
Defines code review standards for the infrastructure team: checklists for different change types (network, compute, security), review time SLA, escalation process for critical changes. Implements automated review through Danger.js and custom bots, coordinates cross-team review for shared infrastructure.
Collaboration Tools
▼
Documents infrastructure components in docs-as-code format: README.md for Terraform modules with input/output descriptions, basic runbooks in Markdown for routine operations. Uses terraform-docs for module documentation auto-generation and keeps records of infrastructure decisions.
Creates comprehensive infrastructure documentation as code: ADR (Architecture Decision Records) for infrastructure decisions, runbooks with automatic CI validation. Generates network diagrams from Terraform through inframap, maintains inventory documentation and configures automatic publishing through MkDocs.
Designs infrastructure documentation system: auto-generation from IaC code (terraform-docs, ansible-doc), live architecture diagrams through Mermaid/D2, service catalog integration. Implements documentation testing (broken links, schema validation), creates postmortem templates and designs knowledge base for on-call engineers.
Defines infrastructure documentation standards for the organization: mandatory sections for each Terraform module, runbook and playbook templates, ADR standards. Implements docs-as-code pipeline with review process, reviews team documentation for completeness and coordinates on-call handbook creation.
Concurrency & Parallelism
▼
Understands the fundamentals of Async Programming at a basic level. Applies simple concepts in work tasks using HCL/Python. Follows recommendations from senior developers when solving problems.
Independently applies async programming in infrastructure automation: concurrent host management operations, async configuration deployment, non-blocking monitoring and health checks. Understands trade-offs between parallel and sequential infrastructure operations.
Designs async architectures for infrastructure automation: concurrent multi-host management, async configuration deployment at scale, non-blocking infrastructure monitoring. Mentors team on async patterns for reliable infrastructure operations.
Implements asynchronous execution patterns in infrastructure automation: parallel deployment to server groups, concurrent health checks, non-blocking metrics collection. Standardizes timeout handling and retry strategies for cloud API operations that may take minutes.
Understands parallelism and multithreading concepts in infrastructure tool context. Knows how concurrent access affects Terraform state files and deployment processes.
Implements parallel infrastructure task execution: concurrent server provisioning, parallel health checks. Manages concurrency when working with shared state and distributed locks.
Designs parallel provisioning pipelines considering resource dependencies and cloud API rate limits. Optimizes infrastructure tool performance with async I/O and worker pools.
Defines parallel infrastructure management patterns for the organization: concurrent deployments, rolling updates. Designs distributed task execution architecture for scaling infrastructure operations.
Container Security
▼
Runs basic container image scanning through Trivy or Grype: CVE analysis in dependencies, Dockerfile configuration checks for common security errors. Can read scan reports and determine vulnerability severity in the context of infrastructure images.
Integrates container scanning into CI/CD pipeline: configuring Trivy/Grype as gate in GitHub Actions, automatic image scanning on registry push. Configures admission policies by severity level, sets up CVE whitelists and monitors for new vulnerabilities.
Designs comprehensive container security system: runtime scanning through Falco, Kubernetes admission controller for image verification, SBOM generation through Syft. Configures automatic base image patching and integrates scanning results with SIEM system.
Defines container security standards for the organization: image admission policies for production, vulnerability remediation SLA by severity, zero-day CVE handling processes. Implements shift-left security through development-stage scanning and reviews container workload security architecture.
Containerization
▼
Works with Docker at basic infrastructure engineer level: building images for infrastructure utilities, running containers with proper volume mounts, configuring docker-compose for local environment. Understands layered filesystem, layer caching and basic isolation principles.
Configures Docker infrastructure for production: optimizing multi-stage builds, configuring private registry (Harbor, ECR), managing container resources through cgroups. Automates CI/CD for images, implements vulnerability scanning through Trivy and configures garbage collection for registry.
Designs corporate Docker infrastructure: hardened base image standards, multi-arch builds, Docker BuildKit configuration with S3 caching. Optimizes containerd runtime configuration, configures storage drivers for high loads and integration with corporate PKI for image signing.
Defines containerization standards for the organization: base image policies with automatic updates, scanning pipelines, tagging strategies. Reviews team Dockerfiles for best practices compliance, manages registry infrastructure with geo-replication and retention policies.
Database Administration
▼
Configures scheduled backups for infrastructure components using automation tools (cron, systemd timers). Monitors backup job completion and alerts on failures. Understands storage requirements for backup retention policies and assists with disaster recovery drills.
Implements infrastructure-level backup solutions using snapshot-based and agent-based approaches. Configures backup orchestration across multiple systems with centralized monitoring. Manages backup storage tiers (hot, warm, cold) and automates disaster recovery runbooks.
Designs multi-region disaster recovery architectures with automated failover and failback procedures. Implements infrastructure-as-code for backup topology ensuring consistency across environments. Optimizes RTO/RPO targets through tiered backup strategies and conducts chaos engineering for DR validation.
Defines data management strategy at product level. Establishes Backup and Disaster Recovery standards. Conducts data schema and scaling strategy reviews.
Understands database replication basics: primary-replica architecture, network requirements, and storage considerations. Monitors replication health through infrastructure dashboards and alerts. Follows team procedures for provisioning replica instances and configuring network connectivity.
Provisions and manages replicated database infrastructure: automated replica deployment, storage IOPS planning, and network latency optimization between regions. Configures monitoring for replication lag, disk usage, and failover readiness. Implements infrastructure-as-code for HA database clusters.
Designs infrastructure for multi-region replicated database clusters: network topology for low-latency replication, storage architecture for consistent performance, and automated DR failover. Optimizes infrastructure costs while meeting RPO/RTO SLAs. Mentors team on HA infrastructure patterns.
Defines data management strategy at product level. Establishes Replication and High Availability standards. Conducts data schema and scaling strategy reviews.
Database Optimization
▼
Understands basic database indexing principles and their impact on performance. Can create indexes within infrastructure migrations and monitor their usage.
Automates index management through IaC: creation, monitoring and optimization for managed databases. Configures alerts for slow queries and missing indexes in RDS and Aurora instances.
Designs indexing strategy for managed cloud databases with automatic monitoring through CloudWatch. Implements automated index recommendations and performance insights into infrastructure monitoring.
Defines database performance management standards at infrastructure level, including auto-scaling and read replicas. Designs observability solutions for monitoring index efficiency at scale.
Distributed Tracing
▼
Understands basics of OpenTelemetry for infrastructure observability. Follows team guidelines for deploying and configuring OTel Collectors, exporters, and telemetry pipeline components. Reads infrastructure metrics and traces to troubleshoot service deployment and networking issues.
Configures OpenTelemetry infrastructure: deploying OTel Collector as DaemonSet and Sidecar, configuring pipelines (receivers, processors, exporters). Integrates OTel with Prometheus for metrics, Jaeger/Tempo for traces and Loki for logs, configures sampling strategies for data volume optimization.
Designs production-grade OTel architecture: multi-layer collector topology (agent → gateway → backend), tail-based sampling for intelligent filtering, batching and retries. Configures correlation between traces/metrics/logs, optimizes collector resource consumption and integrates OTel with service mesh telemetry.
Defines distributed tracing standards for the organization: mandatory instrumentation for all services, span naming and attribute convention standards, sampling policies. Implements OTel Operator for Kubernetes, reviews team configurations and designs self-service onboarding for the observability stack.
DNS & Networking
▼
Uses existing CDN configurations to serve static assets and media. Understands DNS-based routing and edge location concepts. Performs cache purges and basic troubleshooting under senior guidance.
Manages CDN infrastructure using Terraform or CloudFormation with multi-origin setups. Configures edge rules for geo-routing, header manipulation, and WAF integration. Monitors CDN performance metrics and troubleshoots latency issues.
Designs infrastructure solutions with CDN and Edge Computing. Optimizes cost and performance. Implements best practices and security hardening.
Architects global CDN topology with edge computing for latency-critical workloads. Establishes IaC standards for CDN provisioning and cache governance across teams. Drives FinOps practices to optimize CDN spend and bandwidth costs.
Understands basic load balancing concepts: round-robin, least-connections algorithms, and L4/L7 load balancers. Follows team procedures for configuring Nginx/HAProxy and monitoring backend health with basic health check endpoints.
Independently configures load balancing with Nginx/HAProxy/Envoy: upstream configurations, session persistence, rate limiting, and SSL/TLS termination. Implements IaC for load balancer provisioning and monitoring dashboards for traffic distribution.
Designs load balancing architecture for high-traffic systems: ECMP routing, DPDK-accelerated proxying, and global server load balancing (GSLB). Optimizes for minimal latency with connection pooling, keep-alive tuning, and hardware offloading.
Defines load balancing infrastructure strategy: balancer technology selection (hardware vs software), HA configuration standards, and capacity planning for traffic growth. Establishes monitoring, alerting, and incident response procedures for load balancer failures.
Understands basic VPN and network isolation concepts: tunnel protocols (IPSec, OpenVPN, WireGuard), VLAN segmentation, and network ACLs. Uses existing IaC templates to deploy VPN gateways and configure routing tables. Follows team standards for network topology documentation and access control policies.
Independently configures and manages VPN infrastructure: deploys site-to-site and client VPN solutions with high availability and failover. Implements network micro-segmentation using firewall zones, security groups, and service mesh integration. Writes IaC for automated VPN provisioning and certificate rotation.
Designs enterprise VPN and network isolation architectures: multi-region mesh topologies, zero-trust network access with ZTNA gateways, and hybrid cloud connectivity with dedicated interconnects. Optimizes throughput and latency for high-bandwidth tunnels. Implements security hardening with certificate pinning and MFA integration.
Defines network security strategy for VPN and isolation across the organization: establishes encryption standards, network segmentation policies, and connectivity governance for hybrid environments. Conducts architecture reviews for complex multi-site deployments. Drives adoption of zero-trust network architectures.
Git & Workflows
▼
Uses Git for basic infrastructure code management: cloning repositories with Terraform modules, creating branches for configuration changes, commit and push. Understands .gitignore for excluding terraform.tfstate and secrets, can resolve simple merge conflicts in YAML files.
Applies advanced Git practices in IaC repositories: branching strategy for Terraform modules, cherry-pick for production configuration hotfixes, git bisect for finding regressions. Configures pre-commit hooks for terraform fmt, tflint and detect-secrets, manages git submodules for shared modules.
Designs Git workflow for infrastructure repositories: monorepo vs polyrepo strategy for Terraform, GitOps branching model for Kubernetes manifests, automated release pipeline. Configures CODEOWNERS for critical configurations, git-crypt for secret encryption and optimizes work with large state files.
Defines Git standards for the infrastructure organization: unified branching strategy for IaC repositories, commit message standards for automated changelog, protected branch policies. Implements GitOps approach (ArgoCD, Flux) for Kubernetes and Terraform, reviews team git workflows and defines disaster recovery for git repositories.
GraphQL
▼
Understands basics of GraphQL as an interface for infrastructure management APIs. Reads GraphQL queries for resource provisioning and monitoring dashboards. Follows team conventions for infrastructure-as-code tool GraphQL API integrations.
Designs GraphQL API for internal infrastructure management platform: resource queries, deployment status. Implements resolvers with integration to cloud APIs and monitoring systems.
Develops scalable GraphQL API for IDP with real-time infrastructure change subscriptions. Implements caching and batching for optimizing queries to multiple cloud API providers.
Defines GraphQL API architecture for organizational platform services with federation and schema governance. Designs unified API for managing multi-cloud infrastructure through a single GraphQL endpoint.
Infrastructure as Code
▼
Understands basic Ansible concepts for infrastructure configuration management — playbooks, inventory, modules, and the agentless architecture. Follows team playbooks for server provisioning, OS configuration, package management, and basic monitoring agent deployment. Uses ansible and ansible-playbook commands to execute existing automation and checks output for task failures on managed infrastructure hosts.
Independently writes Ansible playbooks and roles for infrastructure lifecycle management including bare-metal provisioning, storage configuration, network setup, and monitoring stack deployment. Implements inventory management with group variables, host-specific overrides, and dynamic inventory sources for CMDB and cloud API integration. Structures infrastructure automation with modular roles, Jinja2 templates for config generation, and handlers for service orchestration across server fleets.
Designs Ansible automation architecture for enterprise infrastructure management across data centers and cloud environments. Implements advanced patterns including custom connection plugins for network devices, callback plugins for ITSM integration, and Tower/AWX workflows for multi-stage infrastructure provisioning. Optimizes Ansible for large-scale infrastructure operations through performance tuning, custom inventory plugins, and integration with configuration management databases for compliance tracking.
Defines Ansible automation standards for infrastructure engineering teams across the organization. Establishes infrastructure-as-code practices with Ansible including role development guidelines, testing frameworks with Molecule, and Tower/AWX governance for change management and self-service provisioning. Conducts architecture reviews of infrastructure automation and drives standardization of server provisioning, configuration management, and lifecycle automation patterns.
Understands Crossplane resource model and Composition basics. Applies pre-built XRDs and Claims to provision cloud resources. Troubleshoots failed resource syncs using kubectl and provider status events.
Independently configures and manages Crossplane. Writes IaC for common tasks. Understands networking and security basics.
Designs multi-cloud Crossplane Compositions with cost-optimized resource patches. Implements ProviderConfig rotation for credential security. Builds Composition pipelines with validation webhooks and drift detection.
Defines infrastructure strategy with Crossplane. Establishes IaC standards. Conducts architecture review. Optimizes FinOps.
Understands basic Pulumi concepts: resource providers, stack references, and state backends. Uses existing Pulumi programs to provision and update infrastructure components. Follows team standards for project structure, naming conventions, and secret management with Pulumi ESC.
Independently develops Pulumi infrastructure programs with custom providers, dynamic resources, and import workflows. Implements networking, compute, and database provisioning with proper state management. Writes reusable component resources and integrates Pulumi into GitOps deployment pipelines.
Designs enterprise-grade infrastructure solutions with Pulumi: multi-account architectures, custom resource providers, and Automation API for self-service platforms. Optimizes cloud costs through right-sizing automation and resource lifecycle policies. Implements CrossGuard policies and security hardening.
Defines infrastructure-as-code strategy with Pulumi across the organization: establishes coding standards, testing frameworks, and component library governance. Conducts architecture reviews for complex multi-cloud deployments. Drives FinOps optimization through policy enforcement and cost allocation tagging.
Understands Terraform core concepts: declarative infrastructure definition, provider ecosystem, and plan/apply cycle. Writes resource definitions for compute, networking, and storage. Understands state file structure and remote backends. Can import existing resources into Terraform management.
Develops Terraform configurations for common infrastructure tasks: VPCs with subnets and security groups, EC2/GCE instances, DNS records, S3 buckets. Uses terraform plan/apply in CI, manages state through remote backend (S3+DynamoDB), applies variables and outputs for module parameterization.
Designs modular Terraform architecture: reusable modules for networks, clusters, databases, workspace strategy for environments. Configures Terragrunt for DRY configurations, implements policy-as-code through OPA/Sentinel, optimizes plan/apply time for large state files.
Defines Terraform standards for the organization: repository structure, resource naming conventions, state separation strategy. Implements Terraform Cloud/Enterprise for teamwork, reviews modules for security and efficiency, designs drift detection and automatic remediation process.
Infrastructure Security
▼
Understands basic cloud security principles: IAM users and roles, principle of least privilege, MFA for console access. Knows why security groups and NACLs are needed, can verify S3 bucket public accessibility and follows basic AWS/GCP security recommendations.
Configures cloud security through IaC: IAM policies with conditions and boundaries, SCPs for Organization, encryption at rest through KMS. Configures CloudTrail for auditing, AWS Config Rules for compliance checks, sets up VPC Flow Logs for network traffic monitoring.
Designs cloud infrastructure security architecture: multi-account strategy with security hub, centralized logging through CloudTrail + S3 + Athena, GuardDuty for threat detection. Implements CSPM (Cloud Security Posture Management), configures automatic remediation through Lambda and designs cross-account access patterns.
Defines cloud security standards for the organization: baseline security controls for each account type, IAM role standards, data encryption policies. Reviews team security architectures, implements security guardrails through SCPs and Terraform modules, defines SLO for vulnerability time-to-remediate.
Understands basic Kubernetes security principles: running containers as non-root user, using readOnlyRootFilesystem, limiting capabilities. Knows why NetworkPolicy and RBAC are needed, can check pod security context and follows basic CIS Kubernetes Benchmark recommendations.
Configures Kubernetes cluster security: RBAC with principle of least privilege, NetworkPolicy for traffic segmentation between namespaces, Pod Security Standards (restricted profile). Implements manifest scanning through kube-bench and kubesec, restricts API server access.
Designs comprehensive Kubernetes security: admission controllers (OPA Gatekeeper, Kyverno) for policy enforcement, runtime security through Falco, network segmentation through Cilium NetworkPolicy. Configures audit logging, encrypts secrets at rest through KMS provider and designs workload identity for cloud services.
Defines Kubernetes security standards for the organization: Kyverno/OPA policies for all clusters, image admission standards, security review process for Helm charts. Implements security-as-code approach, reviews team RBAC matrices and designs incident response process for Kubernetes incidents.
Understands the fundamentals of Network Security. Applies basic practices in daily work. Follows recommendations from the team and documentation.
Configures infrastructure network security: multi-tier segmentation (DMZ, private, database subnets), VPN for secure remote access, TLS termination on load balancer. Configures IDS/IPS rules, sets up VPC Flow Logs for traffic analysis and automates firewall rules through Terraform.
Designs enterprise-grade network security: micro-segmentation through Cilium/Calico NetworkPolicy, mTLS for service-to-service communication, DDoS protection through AWS Shield/CloudFlare. Implements network detection and response (NDR), configures deep packet inspection and designs secure connectivity for hybrid cloud.
Defines organizational network security standards: segmentation policies for all environments, TLS configuration standards, firewall change management processes. Reviews team network architectures for zero-trust compliance, implements automated network policy auditing and defines SLO for security patching.
Uses HashiCorp Vault for basic secret operations: retrieving credentials through vault CLI, understanding KV secret engine, token authentication. Knows why secrets should not be stored in code or environment variables and can integrate Vault with simple bash scripts.
Administers Vault for infrastructure secrets management: configuring auth methods (Kubernetes, AWS IAM, LDAP), PKI secret engine configuration for TLS certificates. Automates database credential rotation, configures access policies and integrates Vault with Terraform through provider.
Designs production-grade Vault infrastructure: HA cluster with Raft storage, auto-unseal through AWS KMS, disaster recovery through replication. Configures dynamic secrets for all databases and cloud providers, implements Vault Agent for transparent secret injection into Kubernetes pods.
Defines secrets management standards for the organization: Vault namespace architecture for multi-tenant, secret rotation and TTL policies, team onboarding process. Reviews Vault policies and auth configurations, designs self-service portal for managing secrets and certificates.
Integration Testing
▼
Understands the role of integration testing in verifying infrastructure component interactions. Writes simple tests for checking network connectivity and service availability after deployment.
Creates integration tests for infrastructure: DNS resolution verification, firewall rules, load balancer routing. Uses InSpec and Goss for server configuration validation after provisioning.
Designs comprehensive infrastructure integration tests with ephemeral environments and smoke tests. Implements chaos testing with Chaos Monkey and Litmus for infrastructure fault tolerance verification.
Defines infrastructure integration testing strategy including game-day exercises and disaster recovery tests. Establishes pre-production validation and automated rollback standards when issues are detected.
Kubernetes & Orchestration
▼
Deploys services to Kubernetes using pre-built Helm charts from repositories. Understands release management concepts: install, upgrade, rollback. Reads Helm template output to verify generated manifests.
Creates Helm charts with environment-specific overlays and secret management integration. Configures Helm repositories and manages chart versioning for infrastructure components. Writes Helm tests and integrates chart validation into deployment pipelines.
Designs infrastructure solutions with Helm. Optimizes cost and performance. Implements best practices and security hardening.
Architects Helm-based deployment strategy across multi-cluster Kubernetes environments. Establishes IaC standards for chart development, testing, and promotion workflows. Optimizes Helm release management for large-scale infrastructure with FinOps practices.
Understands core Kubernetes concepts: pods, nodes, namespaces, and labels. Performs basic cluster operations like scaling replicas and restarting deployments under guidance.
Manages Kubernetes clusters with custom resource definitions and operators. Configures persistent storage, resource quotas, and horizontal pod autoscaling for production workloads.
Designs infrastructure solutions with Kubernetes Advanced. Optimizes cost and performance. Implements best practices and security hardening.
Defines Kubernetes platform strategy including cluster provisioning automation, security hardening standards, and disaster recovery procedures. Conducts architecture reviews for workload placement and resource optimization.
Performs basic Kubernetes operations as an infrastructure engineer: deploying applications via kubectl, viewing logs and pod statuses, basic namespace navigation. Understands core resources — Pod, Deployment, Service, ConfigMap — and can diagnose CrashLoopBackOff and ImagePullError.
Administers Kubernetes clusters: configuring Ingress controllers (nginx, traefik), setting up RBAC and NetworkPolicy, managing StorageClass and PersistentVolume. Automates deployment through Helm, configures resource requests/limits and HPA, monitors cluster health through metrics-server.
Designs production-grade Kubernetes infrastructure: cluster deployment through kubeadm/kOps/EKS, CNI configuration (Calico, Cilium), etcd setup for fault tolerance. Optimizes scheduler, configures PodDisruptionBudget and topologySpreadConstraints, designs cluster upgrade strategy.
Defines Kubernetes platform standards for the organization: multi-tenant cluster architecture, namespace policies, deployment standards through GitOps. Reviews team Kubernetes manifests, designs self-service abstractions on top of K8s and defines SLO for control plane and workload availability.
Logging
▼
Works with structured logging in infrastructure context: reading JSON logs through jq, basic log navigation in Kibana/Grafana Loki, filtering by severity and service name. Understands the difference between syslog, journald and application logs, can find errors in infrastructure service logs.
Configures centralized logging for infrastructure: deploying Fluentd/Fluent Bit for log collection, configuring processing pipelines (parsing, enrichment, routing). Automates ELK/Loki deployment through Helm, configures retention policies and indexing for efficient search across millions of records.
Designs production-grade logging infrastructure: multi-tenant ELK clusters, Loki with S3 backend for cost-effective storage, Kafka as buffer for peak loads. Optimizes storage costs through tiered storage, configures correlation ID for log-based tracing and designs alerts for log pattern anomalies.
Defines logging standards for the organization: unified structured log format, mandatory fields (trace_id, service, environment), retention policies by data class. Reviews team logging configurations, designs self-service log access and defines SLO for log ingestion latency and availability.
Message Queues & Event Streaming
▼
Uses Apache Kafka at a basic level in Terraform/Pulumi. Performs simple tasks using established templates. Understands basic concepts and follows team practices.
Independently implements tasks with Apache Kafka in Terraform/Pulumi. Understands internals and optimizes performance. Writes tests with Terratest.
Administers Kafka clusters as part of infrastructure: configuring replication, monitoring consumer lag, optimizing partition strategy. Automates topic management through Terraform provider, ensures broker fault tolerance and configures alerts on performance degradation.
Designs Kafka infrastructure as a platform service for development teams: cluster deployment standards, retention policies, authorization schemas through ACL. Implements GitOps approach to Kafka topic management and defines SLO for broker throughput and latency.
Metrics & Monitoring
▼
Uses Prometheus and Grafana for basic infrastructure monitoring: viewing standard dashboards (node-exporter, kube-state-metrics), executing simple PromQL queries (rate, sum). Understands Prometheus data model (metrics, labels, timestamps) and can find issues through existing alerts.
Administers Prometheus stack for infrastructure monitoring: deployment through kube-prometheus-stack, configuring ServiceMonitor for target auto-discovery, creating Grafana dashboards. Writes intermediate PromQL queries (histogram_quantile, absent), configures alerting rules and Alertmanager receivers.
Designs scalable Prometheus infrastructure: federation for multi-cluster monitoring, Thanos/Cortex for long-term storage and global query, highly available Alertmanager. Optimizes metric cardinality, configures recording rules for query performance and designs Grafana dashboards-as-code through Jsonnet.
Defines monitoring standards for the organization: mandatory metrics (RED/USE methods), standard dashboards for each service type, alert creation process with runbooks. Implements Grafana-as-a-service for self-service monitoring, reviews team alerting rules and defines SLO for monitoring infrastructure.
Networking
▼
Understands basic networking concepts for infrastructure management — IP addressing, VLAN configuration, load balancer setup, and firewall rule management. Follows team guidelines for provisioning network infrastructure and troubleshooting connectivity between data center and cloud resources.
Designs network infrastructure for common tasks: VPCs with subnets and route tables, security groups and NACLs, VPN connections for hybrid cloud. Configures DNS zones through Route53/CloudDNS, sets up NAT Gateway and understands BGP for interconnect connections.
Designs complex network architectures: Transit Gateway for hub-and-spoke topology, VPC peering between regions, Direct Connect/Interconnect for hybrid scenarios. Optimizes traffic routing, configures advanced DNS (GeoDNS, failover routing) and designs network segmentation for compliance.
Defines organizational infrastructure network standards: IP addressing and CIDR planning for hundreds of VPCs, firewall rule standards, DNS naming policies. Reviews team network architectures, designs network traffic observability and defines SLO for network availability.
OOP & Design Patterns
▼
Knows main design patterns and understands their application in infrastructure context. Uses Template Method and Factory patterns when writing infrastructure automation scripts.
Applies Builder pattern for constructing complex infrastructure configurations and Adapter for cloud integrations. Uses Strategy for deployment strategy selection: blue-green, canary, rolling update.
Designs infrastructure tools using patterns: Pipeline for deployment, Observer for event monitoring. Implements Circuit Breaker for fault-tolerant integration with cloud API providers.
Defines organizational infrastructure pattern catalog: immutable infrastructure, cattle vs pets, twelve-factor. Makes architectural decisions based on proven patterns for common tasks.
Understands basic OOP principles and their application in infrastructure code. Uses classes and inheritance when writing Python automation utilities for infrastructure management.
Applies SOLID principles when developing infrastructure tools: modular providers, resource abstractions. Uses OOP patterns for creating reusable automation components.
Designs extensible infrastructure frameworks using OOP: plugin systems for cloud providers. Creates abstract interfaces for unifying work with different cloud platforms.
Defines architectural standards for organizational infrastructure code with emphasis on modularity and reusability. Reviews infrastructure tool design for clean architecture principles compliance.
Prompt Engineering
▼
Formulates basic prompts for getting help with infrastructure tasks from AI assistants. Understands the importance of specifying context: cloud provider, tool version and environment constraints.
Creates structured prompts for IaC code generation, incident analysis and cloud cost optimization. Uses chain-of-thought for complex network topology design and DR planning tasks.
Develops prompt library for infrastructure tasks: module generation, architecture review, capacity planning. Applies RAG approach with internal documentation for improving recommendation accuracy.
Establishes prompt engineering standards for the infrastructure team focused on security and compliance. Defines validation process for AI-generated infrastructure solutions before production deployment.
Relational Databases
▼
Performs basic PostgreSQL operations as an infrastructure engineer: server installation through package managers, configuring pg_hba.conf for network access, creating users and databases. Can run backups through pg_dump and monitor state through pg_stat_activity.
Automates PostgreSQL deployment through Ansible roles: configuring postgresql.conf for performance, setting up streaming replication, automatic backups through pgBackRest. Monitors metrics through postgres_exporter in Prometheus, configures alerts on replication lag and connection pool.
Designs fault-tolerant PostgreSQL infrastructure: Patroni configuration for automatic failover, PgBouncer for connection pooling, WAL archiving to S3. Optimizes OS kernel and filesystem parameters for PostgreSQL, plans capacity for IOPS and storage.
Designs PostgreSQL as a platform service for developers: self-service instance creation through Terraform, configuration standards for different workload profiles, update automation. Defines SLO for database availability and performance, reviews team architectural decisions.
REST API
▼
Uses REST APIs of cloud providers and infrastructure services at a basic level: AWS API calls through CLI, Terraform Cloud API requests, Vault API for retrieving secrets. Understands HTTP methods, response codes and token authentication in infrastructure context.
Develops integration scripts with infrastructure service REST APIs: automation through Kubernetes API, programmatic DNS management through Cloudflare/Route53 API, monitoring API integration. Implements retry logic, pagination and rate-limit handling for bulk operations.
Designs REST API for internal infrastructure services: resource provisioning API, self-service portal endpoints, GitOps webhooks. Integrates multiple APIs (cloud providers, Vault, Terraform) into unified automation workflow with proper error handling and idempotency.
Defines API standards for internal platform services: unified error format, naming conventions, versioning, authentication through service accounts. Reviews API interfaces of team infrastructure tools and ensures compatibility with corporate API gateway.
Serverless
▼
Understands serverless function basics and their role in event-driven infrastructure. Deploys pre-configured Lambda/Cloud Functions using IaC templates. Monitors function invocations and basic error logs.
Independently configures serverless functions with proper networking, security groups, and environment management. Implements CI/CD pipelines for function deployment. Understands execution model nuances: timeouts, memory, and retry policies.
Designs production-grade serverless infrastructure with multi-region failover, DLQ handling, and observability. Optimizes function performance and cost through right-sizing and provisioned concurrency. Implements security hardening and least-privilege IAM.
Defines platform-wide serverless strategy including standards for function design, deployment patterns, and operational runbooks. Establishes FinOps practices for serverless cost optimization. Reviews cross-team serverless architectures for reliability and security.
Service Mesh
▼
Understands Envoy listener/cluster/route architecture and xDS API basics. Uses existing configurations to route traffic between services. Debugs connectivity issues using Envoy admin interface and access logs.
Independently configures and manages Envoy Proxy. Writes IaC for common tasks. Understands networking and security basics.
Designs Envoy fleet configurations with advanced load balancing (ring hash, Maglev) and circuit breaking. Implements rate limiting with external gRPC services and custom Lua/Wasm filters. Hardens mTLS settings with SDS integration and certificate rotation.
Defines infrastructure strategy with Envoy Proxy. Establishes IaC standards. Conducts architecture review. Optimizes FinOps.
Understands basic Istio service mesh concepts like sidecars and virtual services. Applies existing traffic routing configurations. Monitors service communication under senior engineer guidance.
Independently configures and manages Istio Service Mesh. Writes IaC for common tasks. Understands networking and security basics.
Designs multi-cluster Istio deployments with advanced traffic management. Implements mTLS policies and authorization rules for zero-trust networking. Optimizes Envoy proxy resource consumption and latency overhead.
Defines infrastructure strategy with Istio Service Mesh. Establishes IaC standards. Conducts architecture review. Optimizes FinOps.
Specialized Testing
▼
Understands infrastructure-level chaos: knows that server, disk, network, and DNS failures can be tested. Understands how redundancy (multi-AZ, replication) protects against infrastructure failures. Participates in disaster recovery testing.
Conducts infrastructure chaos experiments: tests database failover (RDS failover, Redis sentinel), network partition between AZs, disk failure scenarios. Uses AWS Fault Injection Simulator or terraform-based fault injection for cloud infrastructure.
Designs infrastructure resilience testing: creates automated DR drills, tests backup/restore procedures under load, implements region failover experiments. Configures infrastructure monitoring for chaos impact detection and automatic rollback.
Defines infrastructure resilience strategy: designs multi-region failover architecture validated through chaos, creates infrastructure chaos suite for continuous verification. Standardizes DR procedures and ensures RTO/RPO compliance through regular testing.
System Design
▼
Understands basic capacity planning concepts: CPU/memory/disk sizing, baseline measurements, and utilization thresholds. Follows team procedures for monitoring infrastructure resource consumption and alerting on capacity limits.
Applies capacity planning for on-premise and hybrid infrastructure: server procurement planning, storage growth forecasting, and network bandwidth analysis. Implements monitoring dashboards for capacity trend visualization and alerting.
Conducts capacity planning for infrastructure components: load forecasting based on historical metrics, Kubernetes cluster growth planning, IOPS calculation for storage subsystem. Builds resource consumption models (CPU, RAM, network bandwidth) and defines scaling points for critical services.
Defines capacity planning process for the organization: regular resource utilization reviews, forecast models based on business metrics, quarterly infrastructure budgeting. Implements automatic capacity monitoring through Prometheus alerts and coordinates planning with development teams for new launches.
Understands basic disaster recovery concepts: backup types (full, incremental, differential), recovery procedures, and failover basics. Follows team guidelines for backup verification, restore testing, and hardware redundancy checks.
Applies DR design for on-premise and hybrid infrastructure: RAID configurations, SAN replication, warm/hot standby servers. Implements automated backup schedules and conducts quarterly DR testing with documented recovery procedures.
Designs disaster recovery for critical infrastructure: multi-AZ architecture with automatic failover, backup strategy with cross-region replication, recovery runbooks. Configures automatic DR testing through chaos engineering (Chaos Monkey, Litmus), defines RPO/RTO for each component.
Defines DR standards for organizational infrastructure: service classification by criticality (Tier 1-4), standard DR patterns for each tier, regular DR drills. Reviews team DR plans, implements automated failover testing and coordinates quarterly disaster recovery exercises.
Understands basic system design principles and infrastructure components: DNS, load balancers, CDN. Knows the difference between horizontal and vertical scaling and use cases for each.
Designs infrastructure for common architectures: three-tier applications, microservices, event-driven systems. Considers availability, performance and cost requirements when selecting components.
Develops infrastructure architecture for high-load systems considering CAP theorem and trade-offs. Designs multi-region deployment with failover, data replication and split-brain protection.
Defines infrastructure architecture standards for different service criticality levels. Creates reference architectures and landing zones for fast onboarding of new product teams.
Type Systems
▼
Understands type safety concept and its role in preventing errors in infrastructure code. Uses basic types in Terraform variables and TypeScript for CDK configurations.
Applies strict typing in infrastructure code: Terraform variable types, Pulumi with TypeScript, CDK constructs. Creates typed interfaces for infrastructure modules to prevent configuration errors.
Designs type-safe infrastructure abstractions with generic types for reusable modules. Implements custom validation rules and type guards for preventing invalid infrastructure configurations.
Defines type safety standards for organizational infrastructure code with automatic verification in CI/CD. Designs type-safe API for internal platform with compile-time configuration checks.
Unit Testing
▼
Writes basic unit tests for infrastructure scripts and automation utilities. Understands the importance of testing for preventing errors in server configurations and network settings.
Creates unit tests for Terraform modules, Ansible roles and infrastructure Lambda functions using mocks. Uses terratest and Molecule for automatic IaC component verification in CI/CD.
Develops infrastructure code testing framework with policy tests, compliance checks and drift detection. Implements contract testing for interfaces between infrastructure modules and applications.
Defines infrastructure testing strategy for the organization: unit, integration and acceptance tests for IaC. Establishes quality gate standards for infrastructure changes with automatic verification in pipeline.
Web Frameworks
▼
Uses Python Web Frameworks at a basic level in Terraform/Pulumi. Performs simple tasks using established templates. Understands basic concepts and follows team practices.
Independently implements tasks with Python Web Frameworks in Terraform/Pulumi. Understands internals and optimizes performance. Writes tests with Terratest.
Develops internal APIs and web interfaces for infrastructure services on Flask/FastAPI: self-service provisioning portals, API wrappers over Terraform and Ansible, monitoring dashboards. Integrates Python backends with cloud SDKs and configuration management systems.
Designs internal platform service architecture on Python: self-service API for infrastructure management, webhook servers for GitOps pipelines, admin panels. Defines infrastructure backend development standards, reviews integrations with Terraform Cloud API and Vault.