DevOps Engineer Job Description Template & Rubric

The short answer

A DevOps engineer job description should say who the engineer serves and what they will be measured on. DevOps engineers own the path from commit to production, SREs own reliability targets and toil, and platform engineers build internal products for developers. Pick the variant, use the template below, and pair each responsibility with a screening question.

Hiring for this?

Conntal places DevOps engineers on contract, contract-to-hire or direct hire, each screened by a practitioner before you see a CV.

DevOps, SRE and platform engineer postings overlap so much that candidates cannot tell which job they are applying for, and neither can the panel. This page gives you one template and three variants, so you can write the advert that matches the job you actually have. DevOps and platform candidates for ConnTal are screened on real incident scenarios by practitioners from the platform engineering practice at Ace8 and from AceMQ.

Copy-ready DevOps engineer job description

Paste this, replace the capitalised placeholders, and delete anything that is not true of the job.

Title

Senior DevOps Engineer, [PRODUCT OR PLATFORM AREA]. Use SRE or Platform Engineer in the title only if the variant section below describes your job.

About the role

[COMPANY] ships [PRODUCT] on [CLOUD OR ON-PREMISES] using [KUBERNETES, ECS OR VIRTUAL MACHINES]. You will own the path from commit to production and the platform it runs on, and you will be part of the on-call rotation for [SERVICES]. You work with [NUMBER OF] development teams and report to [MANAGER TITLE].

What you will do

Own CI/CD pipelines for [SERVICES]: build, test, security scanning and promotion, with a rollback path for every release.
Manage infrastructure as code in [TERRAFORM OR EQUIVALENT], reviewed and applied through the pipeline rather than by hand.
Operate [KUBERNETES OR OTHER RUNTIME]: upgrades, capacity and disruption planning.
Build observability: metrics, logs, traces and alerts that page on user impact, not on every threshold.
Lead incident response when on call and write blameless post-incident reviews with tracked actions.
Reduce repetitive manual work by automating it, and measure delivery with [LEAD TIME, DEPLOYMENT FREQUENCY, CHANGE FAIL RATE, RECOVERY TIME].
Work with security on secrets handling, image provenance and least-privilege access.

What you bring (five items, no more)

Production experience running [KUBERNETES OR OTHER RUNTIME], including at least one upgrade and one incident you can describe in detail.
Infrastructure as code in a real codebase with reviews and a pipeline.
A CI/CD system you have built or substantially changed, not only used.
Experience being on call and improving what paged you.
Scripting or programming ability in [LANGUAGE] for automation.

Nice to have

[SPECIFIC CLOUD OR TOOL]. If you would train it in a month, it belongs here.
Cloud provider or Kubernetes certification.
Experience with [COMPLIANCE FRAMEWORK].

Engagement

[CONTRACT, CONTRACT-TO-HIRE OR PERMANENT]. On-call: [ROTATION AND HOURS]. [ONSITE, HYBRID OR REMOTE]. [START DATE AND TERM].

DevOps, SRE and platform engineer are three jobs with different measures

Choose the variant by who the engineer serves and how success is measured. DORA's delivery metrics suit DevOps work; error budgets and toil limits suit SRE; platform work is judged as a product with developers as users.

	DevOps engineer	SRE	Platform engineer
Serves	Product teams shipping software	The reliability of a running service	Internal developers
Main output	Delivery pipelines and the infrastructure behind them	Service level objectives, error budgets, incident practice	A self-service internal platform
Measured by	Delivery metrics: change lead time, deployment frequency, failed deployment recovery time, change fail rate and deployment rework rate [1]	Reliability against agreed targets, with operational work held down. Google's SRE organisation has an advertised goal of keeping toil below 50 percent of each SRE's time [2]	Whether developers use it and ship faster. The CNCF paper says platform teams should treat platforms like products and develop them together with users [3]
Line to change in the template	Keep as written	Replace the pipeline lines with SLO, error budget and capacity lines	Replace with platform roadmap, golden paths and developer support lines

Metrics and goals from DORA, Google's SRE book and the CNCF Platforms white paper; the role comparison is practitioner judgement.

Our fuller comparison of when to hire an SRE rather than a DevOps engineer is in the guide on SRE versus DevOps, and the platform-versus-DevOps question is covered separately. This one page covers all three variants; a single posting should name one.

Screening questions mapped to the job description

Each responsibility has one question that tests it. Listen for the third column. Score on whether the candidate asked a clarifying question, named a failure mode and stated a trade-off.

Responsibility	Question	A senior answer contains
CI/CD with rollback	A release is half rolled out and error rates are rising. What do you do in the first ten minutes?	Stops the rollout, confirms impact before acting, rolls back to a known version rather than debugging forward, and asks what changed besides the code (configuration, schema, dependency).
Infrastructure as code	Someone changed a security group by hand in the console. How do you find out, and what do you do?	Drift detection in the pipeline, reconciles by deciding whether the change was right, brings the code to match or reverts it, and then closes the path that allowed a manual change.
Runtime operations	You need to upgrade a Kubernetes cluster that runs stateful quorum-based services. Plan it.	Checks version skew and deprecated APIs first, uses disruption budgets and a controlled node rotation, upgrades a non-production cluster first, and names the rollback point.
Observability	On-call is paged forty times a week and most pages need no action. What do you change?	Pages on user-visible symptoms and objectives, not causes; deletes or demotes alerts that nobody acts on; writes a runbook for each page that stays.
Incident response	Tell me about the worst incident you were on call for.	Specifics: the version, the first metric that looked wrong, what they would change. A concrete follow-up action that shipped. Vague answers about 'scaling issues' are a warning sign.
Reducing manual work	You have six repetitive tasks and time to automate one. How do you choose?	Weighs frequency, time cost, error risk and whether the task is a symptom of a missing capability. Knows automation has its own maintenance cost.
Security collaboration	A service needs access to a credential. How does it get it?	Short-lived, scoped credentials from a managed vault or workload identity rather than long-lived keys in configuration; rotation; auditability.

Practitioner judgement from the platform engineering practice at Ace8 and from AceMQ; see the Kubernetes and DevOps interview guides for deeper question sets.

Contract and permanent DevOps postings differ in four lines

On-call. State whether a contractor is on the rotation. Unstated on-call is the most common surprise.
Access. Say how long cloud, repository and cluster access takes to provision. It comes out of the contract term.
Handover. For a contract, name the runbooks and documentation expected at the end.
Change authority. State whether the engineer can change production, or only propose changes.

ConnTal's indicative from-rates for senior contract engineers are $80 an hour for nearshore and offshore delivery and $120 an hour for onshore, depending on platform scarcity, seniority, clearance and term. They are a starting point, not a quote.

If you want a DevOps engineer screened against this rubric by a practitioner, send us the role brief and we will say plainly whether we can staff it.