Compliance-first delivery
How to hire a DevOps engineer in India
To hire a DevOps engineer in India, first pick the route: a direct hire through your Indian entity, an employer of record, a freelancer, a staff augmentation vendor or a managed DevOps service. Then test real work: a broken pipeline to review, a risky Terraform plan to approve or reject, and an on-call scenario. Start the engineer on read-only, named access through your SSO, and agree working-hour overlap in writing.
Most DevOps hires fail on judgement, not on tool lists
If you plan to hire a DevOps engineer in India, the résumés will look alike: AWS, Azure, Terraform, Kubernetes, Jenkins, every monitoring tool you have heard of. The difference between a good hire and an expensive one shows up later, at the moment someone reads a Terraform plan that quietly replaces a production database, or decides whether to roll back at two in the morning. This page is about testing for that judgement before you commit.
It sits under our staff augmentation service, which explains how engagements work in general, and next to our comparison of augmentation and a project agency. Here we go deeper on one role: the routes for hiring it from India, a seniority matrix you can paste into a job description, an interview kit, the access rules for an outside engineer, and the tax and contract points that catch overseas and Indian buyers out.
Radiatus places DevOps, SRE and platform engineers from our own DevOps & automation practice. You review profiles, interview, and decide. The engineer then works in your repositories, tickets and stand-ups and reports to your lead. Use the kit below whether you hire through us or anyone else.
Five ways to hire a DevOps engineer in India, compared
There is no single right route. The question is who carries employment, continuity and compliance, and how much of that you want on your desk.
| Route | Speed to start | Who directs the work | Cost structure | Continuity | Compliance burden on you |
|---|---|---|---|---|---|
| Full-time hire via your Indian entity | Slowest: sourcing, interviews, then the candidate’s notice period at their current employer | You | Salary, statutory contributions, benefits, recruiter fees, equipment | Highest, if you retain them | Highest: payroll, labour codes, provident fund, TDS on salary |
| Employer of record (EOR) | You still find the candidate; the EOR then employs them | You | Salary and statutory costs plus the EOR’s fee | High: they are an employee, just not yours on paper | Medium: the EOR runs payroll; you still own IP terms and tax-presence questions |
| Freelancer marketplace or direct contractor | Fast | You | Hourly or fixed fee, plus any platform fee | Low: often split across clients, can leave at short notice | Contract, IP assignment, vetting and misclassification risk are all yours |
| Staff augmentation vendor | After you interview the vendor’s shortlist | You, day to day | Monthly or hourly rate per engineer; the vendor employs them | Medium to high: the vendor replaces and hands over if someone leaves | Low: one business contract covering NDAs, IP and notice |
| Managed DevOps service | After onboarding and a reliability review | The provider, against an agreed scope and SLA | Monthly fee for the scope | High for the service, since a team covers it | Low, but you give up day-to-day control |
A common pattern: augment now, recruit a permanent owner in parallel, then let the augmented engineer hand over. If you only want the outcome (pipelines fixed, cluster upgraded), a fixed-scope project under DevOps automation is usually cheaper than paying for a person’s time.
DevOps engineer, SRE or platform engineer: which one do you need?
Job titles blur in India as everywhere. Write the brief around the work, not the label.
- DevOps engineer: owns the path from commit to production: pipelines, infrastructure as code, environments, releases. Hire one when developers wait on infrastructure or deploys are manual and scary.
- Site reliability engineer: owns how production behaves: SLOs, alerting, on-call, incident reviews, capacity. Hire one when you have outages you cannot explain or an on-call rota that burns people out. See SRE & observability.
- Platform engineer: builds the internal product other teams use to ship: templates, self-service environments, a developer portal. Hire one when you have several product teams repeating the same setup work. See platform engineering.
DevOps engineer skills matrix: junior, mid, senior and lead
Use this to set the level in your job description and to calibrate interviewers. Each level assumes the one before it.
| Skill area | Junior | Mid | Senior | Lead |
|---|---|---|---|---|
| Cloud (AWS, Azure, GCP) | Creates resources in one cloud from a clear ticket; understands IAM and network basics | Designs accounts or subscriptions, networking and roles for one product; tags for cost | Owns the landing zone, cross-account access, multi-region recovery and commitment planning | Sets cloud guardrails across teams and argues trade-offs with security and finance |
| IaC (Terraform, OpenTofu) | Edits existing modules, runs plan, asks before apply | Writes reusable modules; remote, locked state; reads a plan line by line | Splits state by blast radius, imports legacy resources, adds drift detection and policy checks | Sets review rules and module standards; chooses tooling with licensing in mind |
| Kubernetes | Deploys with existing charts; uses kubectl describe and logs to debug | Writes manifests with probes, requests and limits; fixes crash loops | Runs upgrades, network policies, Pod Security and autoscaling | Decides whether you need Kubernetes at all, and owns the platform roadmap |
| CI/CD | Adds steps to existing pipelines | Builds pipelines with caching, tests and one artefact promoted through environments | Short-lived cloud credentials, signed artefacts, canary or blue-green releases | Tracks delivery metrics and builds paved paths for every team |
| Observability | Reads dashboards; adds alerts from templates | Instruments services with metrics, logs and traces; writes alerts that mean something | Defines SLOs and error budgets; cuts alert noise and telemetry cost | Agrees reliability targets with product owners |
| Security | Keeps secrets out of code; uses MFA everywhere | Least-privilege roles, a secrets manager, image scanning | Threat-models infrastructure; produces audit evidence; contains incidents | Owns the cloud security baseline jointly with the security team |
| Scripting | Bash and Python for small tasks | Idempotent, tested scripts and small tools | Go or Python tooling against cloud APIs that removes recurring toil | Decides what to build, buy or delete |
| Incident response | Follows runbooks and escalates early | Takes on-call; mitigates common failures; writes the timeline | Acts as incident commander; runs blameless reviews | Designs the rota, severity levels and customer communication |
On IaC tooling: HashiCorp moved Terraform to the Business Source License 1.1 in August 2023, and IBM completed its acquisition of HashiCorp in February 2025. OpenTofu is the MPL-licensed fork under the Linux Foundation. Internal use of either is fine for most companies; our Kubernetes consulting page covers the choice in more detail. A mid-level engineer should know both exist and what differs.
Hiring an AWS DevOps engineer vs an Azure DevOps engineer
Hire an AWS DevOps engineer: what to check
Ask how they structure AWS Organizations and IAM Identity Center, how a GitHub Actions or GitLab job gets into AWS without stored access keys (the answer is OIDC federation into a role scoped to one repository and environment), and how they would choose between ECS and EKS for a team of eight developers. A strong candidate talks about Savings Plans only after rightsizing, and knows where CloudTrail logs go and who can delete them. If you also need someone to run the estate for you, see our AWS managed services page.
Hire Azure DevOps engineers: two different jobs
“Azure DevOps” is both a cloud and a Microsoft product (Boards, Repos, Pipelines, Artifacts). Say which you mean. Someone who runs YAML pipelines, agent pools and service connections is not automatically someone who can design Entra ID roles, management groups, AKS and Bicep or Terraform for your subscriptions. A good test question for either: how should a pipeline authenticate to Azure? Look for workload identity federation rather than a client secret pasted into a service connection.
Do certifications matter when you hire DevOps engineers?
Treat them as weak, positive signals that someone studied. They do not show judgement under pressure. The ones you will see most, with names as of November 2026:
- Certified Kubernetes Administrator (CKA) and Certified Kubernetes Application Developer (CKAD): two-hour, hands-on command-line exams from the Linux Foundation, valid for two years. The most practical of the group.
- AWS Certified DevOps Engineer – Professional (exam DOP-C02): multiple choice, valid for three years.
- Microsoft Certified: DevOps Engineer Expert (exam AZ-400): needs the Azure Administrator Associate or Azure Developer Associate first, and expires unless renewed through Microsoft’s free online assessment.
- HashiCorp Terraform Associate (004): an hour-long multiple-choice exam on Terraform 1.12, valid for two years. Proves vocabulary, not design skill.
Ask a certified candidate to show you something they built after passing. That conversation tells you more than the badge.
A DevOps interview kit you can run in one afternoon
Trial task 1: review a broken pipeline (45 minutes, live)
Share a pipeline file from a sanitised repository with planted problems: long-lived cloud keys stored as CI secrets, container images pinned to latest, tests skipped on the main branch, a production deploy with no environment approval, and a pull_request_target trigger that checks out untrusted code. A strong candidate ranks the security problems first, explains the blast radius of each, and proposes the smallest fix. A weak one rewrites the YAML for style.
Trial task 2: approve or reject a risky Terraform plan (30 minutes)
Show a plan in which a renamed database identifier forces replacement (-/+ destroy and then create replacement), an IAM policy grants "Action": "*", and a security group opens SSH to 0.0.0.0/0. Ask: would you approve this? Good answers refuse, spot the forced replacement of stateful data first, and suggest a moved block or prevent_destroy, a scoped policy, and splitting the change.
Trial task 3: an on-call scenario (20 minutes, spoken)
“Twenty minutes after a deploy, checkout latency triples and errors climb. You are on call.” Listen for: acknowledge and tell people, check what changed, roll back before investigating, confirm recovery with metrics, then write the timeline. Worry if the first move is to SSH into a production server and patch it by hand.
Keep trial tasks short and paid if they run beyond an hour or two. Senior people turn down long unpaid homework, and you lose the candidates you most want.
Questions, and what a good answer contains
| Question | A good answer includes | Worry if you hear |
|---|---|---|
| How do you keep Terraform state safe? | Remote backend with locking and versioning, state split by blast radius, restricted access, encryption | State on a laptop or committed to Git |
| How should CI reach the cloud? | OIDC federation, short-lived credentials, one role per repository and environment | An access key in the CI secret store “for now” |
| What alerts would you set for a new service? | Symptoms users feel (errors, latency), routed by severity, each with a runbook link | Paging someone whenever CPU passes 80 per cent |
| Tell me about an outage you caused. | A specific story, owned plainly, with what changed afterwards | “I have never caused one” |
| When would you not use Kubernetes? | Small team, few services; a managed container service costs less to run | Kubernetes for everything |
| It works in staging and fails in production. Where do you start? | Recent changes, then differences in config, secrets, IAM and network, using logs and the IaC diff | Rebuilding the environment and hoping |
Red flags when you hire DevOps engineers
- Thirty tools on the CV and no clear account of one system they owned.
- Asks for admin or root access in the first week “to move faster”.
- Cannot describe a rollback they performed or a postmortem they wrote.
- Makes production changes by clicking in the console and has no review habit.
- Proposes rebuilding your whole platform before understanding why it looks the way it does.
- Talks about uptime but cannot define an SLO or say what it measures.
Access and security rules for an external DevOps engineer
- Named accounts only, through your identity provider (Entra ID, Okta, Google Workspace) with MFA. No shared logins, no personal email addresses.
- Least privilege, in stages. Week one is read-only plus non-production. Production write access comes through role assumption with approval and a time limit.
- No root and no global admin. The cloud root user stays with your staff, locked with hardware MFA.
- Break-glass is sealed. An emergency account exists, is monitored, and its use triggers an alert and a review.
- Secrets live in a secrets manager, never in chat, tickets or wikis. Anything an engineer has seen gets rotated when they leave.
- Changes go through code review. Audit logging (CloudTrail, Azure Activity Log, Cloud Audit Logs) is on and the engineer cannot switch it off.
- Device policy is in the contract: a managed laptop or your VDI, disk encryption, screen lock, no client data on personal machines.
- Offboarding happens the same day: SSO disabled, tokens and keys revoked, on-call rota updated, repository and pipeline ownership transferred.
The first 30 days: an onboarding plan that works remotely
- Week 1: access through the checklist above; read the architecture notes and runbooks; shadow on-call; ship one small, reviewed change, such as fixing a pipeline warning.
- Week 2: own one backlog item end to end and document one thing that was missing.
- Week 3: join on-call as secondary; review other people’s plans and pull requests.
- Week 4: deliver one agreed improvement, for example removing stored cloud keys from CI, following our CI/CD pipeline guide. Hold a 30-day review on scope, access and the next 60 days.
India-specific contract and tax points
If you are an overseas company
- GST on exported services. An Indian supplier can bill foreign clients without IGST when the supply qualifies as an export of services and it has filed a Letter of Undertaking in Form GST RFD-11 under Rule 96A of the CGST Rules. The LUT is renewed every financial year. Payment in convertible foreign exchange is one of the export conditions, so pay the invoice currency agreed.
- IP assignment in writing. Make the assignment of code and configuration explicit in the contract, whether you contract an individual or a company.
- Long-term direct contractors. An individual who works only for you, full-time, for years, starts to look like an employee. That raises misclassification and tax-presence questions; an EOR or a vendor contract avoids most of them. Ask your tax adviser.
If you are an Indian company
- GST: IT services stayed at 18 per cent after the September 2025 rate rationalisation. A registered business can normally claim it back as input tax credit.
- TDS: from 1 April 2026, deductions sit in section 393 of the Income-tax Act, 2025, and the department has said rates and thresholds carried over from the 1961 Act. Payments for contract work (which includes supply of labour) attract 1 per cent for individuals and HUFs and 2 per cent for others; fees for technical services attract 2 per cent and professional fees 10 per cent. Which row applies to a DevOps engineer’s invoice depends on how the contract is written, so confirm it with your chartered accountant.
- Direct hires: the four labour codes took effect on 21 November 2025 and changed how wages, social security and appointment letters are handled. Budget a full-time hire with your payroll adviser, not from an old salary sheet.
Working-hour overlap with the US, UK, Europe, Australia and the UAE
India keeps Indian Standard Time (UTC+5:30) all year with no daylight saving, so the gap moves when your clocks change.
| Your team | India is ahead by | What usually works |
|---|---|---|
| UAE | 1.5 hours, all year | Almost the whole working day overlaps |
| UK | 5.5 hours in winter, 4.5 in summer | Engineer starts late morning IST and covers the UK morning and early afternoon |
| Central Europe | 4.5 hours in winter, 3.5 in summer | Most of the European morning overlaps on a standard Indian day |
| US East Coast | 10.5 hours in winter, 9.5 in summer | A two-to-three-hour window in the Indian evening; written handovers |
| US West Coast | 13.5 hours in winter, 12.5 in summer | An hour or two at the edges of each day; async-first, follow-the-sun on-call |
| Australia (Sydney) | India is behind by 5.5 hours in the Australian summer, 4.5 in winter | Engineer starts early IST and covers Sydney afternoons |
Agree the overlap window, the on-call expectations and any late-shift arrangement in the contract, not in a chat thread.
DevOps roles we place in your team
Four shapes of engagement. In each one the engineer comes from our own delivery practice, you interview and decide, and the engineer takes direction from your lead.
Embedded DevOps engineer
The problem
Developers spend sprint time on pipelines and cloud tickets, and nobody owns the infrastructure backlog.
How we do it
One engineer joins your team and takes infrastructure work from your backlog through your pull requests and change process. You set priorities. We handle employment, payroll, NDAs and replacement if the fit is wrong.
What you get
- Infrastructure changes as reviewed code
- Pipeline and environment fixes from your backlog
- Runbooks for everything they touch
- A short weekly note for your lead
SRE in your on-call rota
The problem
Alerts fire constantly, incidents repeat, and the same two people are always on call.
How we do it
An SRE joins your rota at an agreed level, cleans up alerting around user-facing symptoms, proposes SLOs, and runs reviews after incidents. Overlap hours and escalation paths are written into the contract.
What you get
- Alert review and noise reduction
- Draft SLOs and error budgets
- Incident timelines and review notes
- Runbooks linked from every page
Platform engineer for your internal platform
The problem
Every product team sets up services its own way, and the platform team’s roadmap is months behind.
How we do it
A platform engineer builds paved paths with your platform lead: service templates, self-service environments and pipeline building blocks, adopted one team at a time.
What you get
- Service and pipeline templates
- Self-service environment workflow
- Adoption notes per team
- Documentation in your portal
Kubernetes or Terraform specialist for a set period
The problem
A cluster upgrade, a state split or an IaC import keeps getting postponed because nobody has done one before.
How we do it
A senior specialist joins for the duration of the job, pairs with your engineers, and leaves the knowledge behind in code, runbooks and recorded walkthroughs.
What you get
- Upgrade or migration plan with rollback steps
- Changes delivered as reviewed code
- Pairing sessions with your team
- Handover document and walkthrough
When teams bring in a DevOps engineer from India
Illustrative situations, not client case studies.
| Situation | Who to add | How it usually runs |
|---|---|---|
| SaaS company with no infrastructure owner | One mid or senior DevOps engineer | Codifies the existing cloud estate, moves CI to short-lived credentials and adds cost tags; your CTO reviews every change |
| Audit date on the calendar | Senior DevOps engineer with a security bent | Least-privilege roles, logging and evidence for security & compliance controls, alongside your compliance lead |
| A Kubernetes cluster nobody fully understands | Senior engineer focused on Kubernetes | Upgrade backlog, autoscaling and cost first; see our Kubernetes cost guide |
| Platform team behind on its roadmap | Platform engineer | Templates and self-service environments delivered under your platform lead’s priorities |
| Users in a time zone your team sleeps through | SRE joining on-call | Covers part of the day in a follow-the-sun handover with written notes |
| Building AI features on top of your platform | DevOps engineer plus an AI developer | Secrets, deployment and cost controls for model calls; see hiring AI developers in India |
Tools our DevOps engineers work in
We adapt to your stack rather than bringing our own. These are the platforms we see most often.
AWS, Microsoft Azure and Google Cloud
Accounts and subscriptions, networking, identity, managed databases and cost controls in all three.
Terraform and OpenTofu
Modules, remote state with locking, imports of hand-built resources, and plan review as part of every change.
EKS, AKS, GKE and managed container services
Cluster operations where Kubernetes is justified, and simpler services such as ECS or Cloud Run where it is not.
GitHub Actions, GitLab CI, Azure Pipelines, Jenkins
Pipelines with short-lived cloud credentials, artefact promotion and approval gates.
Prometheus, Grafana, OpenTelemetry, cloud-native monitoring
Metrics, logs and traces wired to alerts on user-facing symptoms.
Secrets managers, policy as code, image scanning
Vault or cloud secrets services, policy checks in CI and least-privilege roles.
Tools we use alongside it
- Terraform
- OpenTofu
- Kubernetes
- Helm
- Argo CD
- GitHub Actions
- GitLab CI
- Azure Pipelines
- Prometheus
- Grafana
- OpenTelemetry
- Vault
- Bash
- Python
- Go
Facts, versions and vendor details checked November 2026.
How hiring a DevOps engineer through Radiatus works
Every step is yours to approve. We do not publish rates; you get a written proposal with the monthly or hourly rate per engineer after the first call.
Write the role brief together
Skills by level from the matrix above, the overlap window, on-call expectations, duration and the access you can grant in week one.
Review profiles
We propose engineers from our own delivery practice whose experience matches. You see their background before any interview.
Your interview and trial task
Run the kit on this page or your own. Nobody joins without your decision.
Start on the access checklist
Named accounts, read-only first, your repositories and ceremonies. IP is assigned to you and NDAs are in place before access.
First review
Scope, access and fit. Scale up, down or ask for a replacement on the notice agreed in the contract.
A product our cloud engineers run
We operate our own software across AWS, Azure and Google Cloud, so the access, cost and alerting rules on this page are ones we live with too.
Guides and related pages
Guides
Questions about hiring DevOps engineers in India
Decide the route first: a direct hire through an Indian entity, an employer of record, a freelancer, a staff augmentation vendor or a managed service. Write the brief from a skills matrix rather than a tool list, test with a pipeline review, a Terraform plan review and an on-call scenario, and start the engineer on named, read-only access. Agree overlap hours and notice periods in the contract.
It depends on seniority, cloud and Kubernetes depth, on-call duties, the overlap hours you need (late shifts cost more), security requirements such as VDI or background checks, and how long the engagement runs. Radiatus does not publish rates. With staff augmentation you pay a monthly or hourly rate per engineer, set by role and seniority, and get a written proposal after a free consultation.
Yes. Staff augmentation suits work with an uncertain length, such as an AWS migration, a move to OIDC-based CI access or an account restructure. There is no long-term lock-in; notice for scaling down is agreed in the contract. If the scope is fixed and you only want the result, a fixed-price project is often cheaper than paying for time.
Yes, for both meanings of the term: engineers who build and run Azure Pipelines, Repos and Boards, and engineers who design and operate workloads on Microsoft Azure with Entra ID, AKS, Bicep or Terraform. Tell us which you need, because they are different skill sets, and we will propose profiles to match.
Partly. The UK gets a good part of its morning and early afternoon with a late-starting Indian day. The US East Coast usually gets a two-to-three-hour window in the Indian evening, and the West Coast an hour or two. For anything round the clock, one engineer is not enough; use a rota or a managed service.
It can be, if access is designed for it: named accounts through your SSO with MFA, read-only to start, time-limited production roles with approval, no root or global admin, secrets in a manager, audit logs the engineer cannot disable, and same-day offboarding. NDAs and IP assignment should be signed before any access is granted.
Indian clients normally pay GST at 18 per cent on the invoice and can usually claim it as input tax credit. TDS now falls under section 393 of the Income-tax Act, 2025, with rates carried over from the old Act; whether the contract-work or technical-services row applies depends on the contract. Overseas clients are usually billed without GST under the vendor’s LUT. Confirm with your accountant.
Tell us early. We discuss what is not working and, if needed, propose a replacement and support a handover so knowledge stays in your repositories and runbooks. The notice period for a replacement or for scaling down is agreed in the contract before the engagement starts.
Need a DevOps engineer who can be trusted with production?
Send us the role: cloud, tools, seniority, overlap hours and what the first month should deliver. A senior engineer will reply with profiles to interview or an honest note that another route fits better.