DevOps Engineer- Avon

We're looking for a DevOps / Platform Engineer to own our infrastructure end to end- both sides of it.
Side one is our multi-tenant SaaS on AWS: you build it, you run it, you keep it fast, secure, and up. Side two is the part that makes this role unusual - our enterprise customers deploy Avon AI inside their cloud (and sometimes fully air-gapped, on-prem environments). You'll own that too: packaging the platform, running the installation with the customer's infrastructure and security teams, and being the person on the call when their environment doesn't look like anyone's reference architecture.
This is a customer-facing engineering role. You'll be in rooms with enterprise IT, security, and platform teams- walking them through our architecture, answering security review questions, and unblocking deployments. If you want a pure behind-the-scenes infra job, this isn't it. If you like owning infrastructure and being the trusted technical voice in front of a customer, read on.
You'll be our first dedicated DevOps hire, which means you inherit real systems in production and a lot of room to shape how they evolve.
Key Responsibilities
EKS, networking, data stores, CI/CD, cost, and uptime. Build and evolve it with Infrastructure as Code.
Maintain and improve our Helm charts and container distribution so Avon AI installs cleanly in a customer's Kubernetes cluster.
Plan and execute installations in customers' private clouds and on-prem/air-gapped environments, working hands-on with their infrastructure teams from kickoff through go-live.
Support security reviews and architecture discussions, and translate enterprise IT constraints back into our roadmap.
IAM, network segmentation, secrets management, WAF, and the controls enterprise customers audit us on.
Metrics, logs, tracing, and alerting for our SaaS, and self-contained monitoring for customers who won't ship telemetry outside their network.
CI/CD pipelines, ephemeral PR sandboxes, release automation, and local development so engineers ship quickly and safely.
For our SaaS tenants and for deployed customer installations, including on-call ownership of what you build.