[Job-31837] Master Data Developer - Data Ops, Colombia

At CI&T, we help large enterprises transform the potential of AI into real business impact with AI Deployment, AI-native execution, and tech-integrated business solutions.

With 30 years of experience in technological transformation, we accelerate innovation with expertise in Agentic SDLC, Application modernization, Data & AI, Martech and Business strategy.

We are 8,000 CI&Ters across more than 25 countries, collaborating to build solutions with real impact. AI is already part of how we work, evolve, and innovate every day.

About Us:

At CI&T, our rapid growth is fueled by the innovative solutions we create for our global clients. We are seeking a Master DataOps Engineer to own the operational backbone — environments, CI/CD, and monitoring — for a large-scale Finance data platform modernization at a major US mortgage lender, so the platform being built is reliable and cost-governed from day one, not bolted on at the end.

Responsibilities:

Environment Provisioning & Platform Readiness

Own end-to-end environment provisioning and platform readiness across the full data stack — from SQL Server CDC source through Snowflake landing, raw, and curated layers — ahead of and during the build, with a formal readiness checklist delivered before sensitive-data build begins.

Provision and maintain Snowflake environments (DEV → QA → UAT → Prod) with dedicated, right-sized warehouses per workload class — replication/ingestion, curated-layer transformation, and BI serving — each with auto-suspend, resource monitors, and cost attribution from day one.

Coordinate Azure infrastructure provisioning: Virtual Networks, NSGs, Private Endpoints, Azure Key Vault, self-hosted Azure DevOps agents, and VM infrastructure for the CDC replication tool — including firewall rules, TLS certificate requests, and DNS resolution for private Snowflake endpoints, all with documented lead times surfaced proactively.

Manage Snowflake RBAC provisioning: dedicated project-specific role hierarchy, clearly separated from broad IT, developer, analyst, and AI roles; positive and negative access tests executed before the environment is handed over to the build team.

Manage the full vendor and service account access lifecycle: named, individual, time-bound, least-privilege access for all delivery personnel; dedicated non-personal service accounts for replication, Snowflake, and BI integrations; credential storage and rotation via Azure Key Vault; revocation with documented evidence at engagement end.

CI/CD Pipeline Engineering

Build and operate the CI/CD pipeline for all data artifacts — transformation logic, metric definitions, replication configurations, Snowflake object DDL, and versioned SQL transformation models — using Azure DevOps Pipelines with YAML-based, version-controlled pipeline definitions.

Enforce a DEV → QA → UAT → Prod promotion path with branch policies, required reviewers, build validation on PRs, and written approval gates before any production deployment — no silent or automatic production changes.

Integrate automated regression, schema validation, row-count checks, and data quality assertions at every promotion stage — not only before go-live.

Externalize all environment-specific configuration from code; integrate Azure DevOps Variable Groups linked to Azure Key Vault so no credentials are stored as plaintext in pipeline definitions or repository files.

Integrate code scanning, dependency scanning, and IaC scanning (e.g., Checkov, Microsoft Defender for DevOps) into CI pipelines; remediate or formally document exceptions for all material findings before promotion to production.

Design, document, and rehearse rollback procedures for every promotion stage, including a full mock cutover and rollback rehearsal before the production readiness gate.

Monitoring, Alerting & Observability

Implement and own end-to-end pipeline monitoring using Azure Monitor and Log Analytics: replication health, CDC lag alerts, replication agent availability, Snowflake warehouse freshness against agreed SLA targets, schema-change and drift detection events at the landing zone, and semantic-definition change alerts.

Configure Azure Monitor Alert Rules routed via Action Groups to the client's approved ITSM tool (e.g., ServiceNow), with named alert owners, defined thresholds, and documented escalation paths — every alert fully operable by the client's DataOps team without vendor involvement post-handoff.

Enable and maintain Diagnostic Settings on all Azure resources (Key Vault, VMs, NSGs, Storage Accounts) feeding a centralized Log Analytics Workspace with appropriate retention, access control, and audit trails covering authentication, access grants, configuration changes, and deployments.

Implement Snowflake resource monitors and Azure Cost Management budget alerts for cost anomaly detection; produce periodic FinOps attribution reports by workload class.

Platform Cost Governance & FinOps

Own platform cost attribution and consumption monitoring across all Snowflake warehouses and Azure compute resources, with per-workload attribution established from day one using a consistent resource tagging strategy enforced via IaC.

Deliver a Snowflake and Azure cost model at architecture gate, including monitored budgets, right-sizing recommendations, and auto-suspend configurations — not estimated retrospectively.

Conduct periodic right-sizing reviews using Azure Advisor and Snowflake usage data; present findings in structured FinOps reviews with the client's Cloud Architecture team.

Infrastructure as Code

Manage all Azure infrastructure as code using Terraform (or Bicep where appropriate), including VNets, NSGs, Key Vault, VMs, storage accounts, Entra ID service principals, and RBAC role assignments — no manual portal configurations for anything that belongs in the production baseline.

Manage Snowflake object provisioning (databases, schemas, warehouses, roles, resource monitors) via the Snowflake Terraform provider, maintaining remote state in Azure Blob Storage with state locking.

Enforce configuration standards via Azure Policy guardrails (e.g., soft-delete on Key Vault, no public IPs on data resources, mandatory resource tagging) so IaC deployments are validated against policy before they reach production.

Architecture & Operational Documentation

Maintain Architecture Decision Records (ADRs) and other living delivery artifacts alongside the Lead Architect — including network and connectivity design, environment topology, CI/CD promotion model, and security access design — in client-controlled repositories from the first commit.

Write and validate operational runbooks covering: replication failure, recovery, and resynchronization; CDC lag breach response; deployment and rollback procedures; reconciliation-discrepancy triage; access request and revocation workflows; cost-anomaly response; and incident routing via client ITSM — each exercised with the client's DataOps team before final handoff acceptance.

Knowledge Transfer & Client Engagement

Drive progressive knowledge transfer from the architecture phase onward through paired working sessions, shadowed deployments, and runbook exercises — not a single end-of-project handoff.

Act as the named point of contact for platform operations across the delivery team and the client's DataOps, Cloud Architecture, Infrastructure/Network, and Information Security teams — translating technical platform concerns into clear client-facing communications in fluent English.

Quantify and track client infrastructure dependencies — Snowflake environments, Azure network paths, service accounts, replication tool licensing, and production change windows — with named need-by dates and schedule-impact statements, escalating proactively when readiness is at risk.

Requirements:

Solid, hands-on experience in DataOps or platform engineering roles supporting a production cloud data platform end-to-end — covering provisioning, CI/CD, monitoring, and operati