# Infrastructure Engineer

> Design and implement cloud infrastructure. Cover cloud architecture, IaC (Terraform, Pulumi), CI/CD pipelines, container orchestration (Kubernetes), networking, observability, and security hardening. Triggers on "design cloud infrastructure", "set up Terraform", "configure Kubernetes", "build CI/CD pipeline", "infrastructure monitoring", "network architecture", "security hardening", "infrastructure cost optimization", or "platform engineering". For day-2 Kubernetes cluster operations—Helm rollouts, add-ons, RBAC, GitOps sync, workload troubleshooting, use cluster-deployment-engineer. For data center facility design, power/cooling, rack layout, and build commissioning, use data-center-design-execution-lead. For on-prem compute utilization, GPU/CPU supply planning, stranded kW, and hardware refresh efficiency, use data-center-compute-supply-efficiency. For on-site colo smart-hands, rack-and-stack, cabling, and physical acceptance, use field-services-engineer. Compute accounting: compute-accounting-manager.

- Skill: `daemon-blockint-tech/infrastructure-engineer` (Agent Skill, multi-file: 5 files)
- Install (CLI): `npx skillmds@latest add daemon-blockint-tech/infrastructure-engineer`
- Raw SKILL.md: https://api.skillmd.com/api/skills/daemon-blockint-tech/infrastructure-engineer/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: daemon-blockint-tech (https://skillmd.com/u/daemon-blockint-tech)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/daemon-blockint-tech/infrastructure-engineer

---


# Infrastructure Engineer

## Overview

Design and implement cloud infrastructure. This skill covers IaC (Terraform, Pulumi), CI/CD pipelines,
container orchestration (Kubernetes), networking, observability, and security hardening.

## Features

- Infrastructure as Code: Terraform modules, Pulumi stacks, state management, drift detection
- CI/CD pipelines: pipeline essentials, deployment strategies, environment promotion, rollback procedures
- Container orchestration: Kubernetes architecture, Helm charts, service mesh, autoscaling
- Networking: VPC design, load balancers, DNS, CDN, private endpoints
- Observability: metrics, logs, traces, alerting, dashboards
- Security hardening: IAM policies, encryption, network security, compliance controls

## Usage

1. Identify the user's infrastructure need (IaC, CI/CD, Kubernetes, networking, observability, or security)
2. Follow the corresponding workflow below
3. Produce structured outputs: Terraform configs, pipeline definitions, Kubernetes manifests, or architecture diagrams

## Examples

- **User**: "Set up Terraform for AWS"
  **Agent**: Runs IaC workflow, creates module structure, configures state backend, produces VPC, EC2, and RDS resources

- **User**: "Build a CI/CD pipeline"
  **Agent**: Runs CI/CD workflow, designs pipeline with build/test/deploy stages, adds environment promotion and rollback

- **User**: "Configure Kubernetes autoscaling"
  **Agent**: Runs Kubernetes workflow, sets up HPA based on CPU/memory, configures cluster autoscaler, tests scaling behavior

## When to Use

- Designing cloud or hybrid networks, compute, storage, and IAM patterns
- Building CI/CD, GitOps, Kubernetes, or IaC (Terraform/Pulumi/CloudFormation)
- Implementing observability, SRE practices, and infrastructure incident response
- Hardening infrastructure for security and compliance (SOC 2, ISO 27001, etc.)

For security-control ownership (IdP, KMS, SIEM integration, PAM, guardrails as primary deliverable), prefer `information-security-engineer`.

For authorized network/AD/segmentation pentest validation (not IaC design), prefer `network-pentester`.

For internal developer platform, golden paths, Backstage/catalog, and platform-as-product work, prefer `platform-engineer`.

## When NOT to Use

- Data warehouse modeling, ETL, or analytics pipeline SLAs → use `data-warehouse-engineer` or `data-system-ops-lead`
- Data governance catalogs, quality SLAs, or steward workflows → use `data-architect` or `data-manager`
- LLM prompt/agent design or production guardrails → use `prompt-engineer`
- Technical documentation or research synthesis deliverables → use `tech-writer-researcher`
- Cross-service solution architecture before build → use `senior-system-architecture`
- Cloud reference architecture, landing zone, migration design → use `cloud-architect`
- Day-to-day managed cloud services (networking, RDS, serverless, cloud IAM) → use `cloud-engineer`
- K8s cluster workload deploy, upgrades, and in-cluster troubleshooting → use `cluster-deployment-engineer`
- Data center design, MEP, colo build, and facility commissioning → use `data-center-design-execution-lead`
- Physical compute utilization, supply forecast, consolidation, refresh → use `data-center-compute-supply-efficiency`
- Infrastructure org strategy, portfolio prioritization, board/CFO narratives → use `vp-of-infrastructure`
- Cloud program strategy, migration portfolio, CCoE, EA governance → use `vp-of-cloud`
- Customer RFP, discovery, PoC charter, solution handoff (not production build) → use `solutions-architect`

## Core Workflows

### 1. Infrastructure Design & Provisioning

**Design checklist:**

1. **Define requirements**
   - Traffic patterns (steady, bursty, batch)
   - Compliance needs (data residency, encryption)
   - RTO/RPO targets
   - Budget constraints

2. **Choose compute model**
   | Model | When | Trade-off |
   |---|---|---|
   | VMs (EC2/GCE/VM) | Predictable workloads | Management overhead |
   | Containers (EKS/GKE/AKS) | Microservices, portability | Orchestration complexity |
   | Serverless (Lambda/Cloud Functions) | Event-driven, variable load | Cold start, limits |
   | Bare metal | High performance, licensing | Full management burden |

3. **Design network**
   - VPC/VNet with public/private subnets
   - NAT Gateway for outbound-only workloads
   - Transit Gateway for multi-VPC/VNet
   - PrivateLink/Private Service Connect for SaaS

4. **Provision with IaC**
   - Terraform for multi-cloud
   - CloudFormation for AWS-only
   - Pulumi for programmatic (Python/TS)
   - Ansible for configuration management

### 2. CI/CD & Platform Automation

**Pipeline essentials:**
- Build → Test → Security scan → Deploy → Verify
- GitOps with ArgoCD/Flux for K8s
- Feature flags for progressive rollout
- Automated rollback on failure

### 3. Monitoring & Reliability

**Observability stack:**
- Metrics: Prometheus + Grafana, Datadog, CloudWatch
- Logs: ELK, Loki, Splunk
- Traces: Jaeger, Zipkin, AWS X-Ray
- Alerts: PagerDuty, Opsgenie, Alertmanager

**Reliability patterns:**
- Health checks: liveness, readiness, startup probes
- Circuit breakers: fail fast, degrade gracefully
- Rate limiting: token bucket, leaky bucket
- Bulkheads: isolate failure domains

### 4. Security & Compliance

**Security by layer:**
- Network: Security groups, NACLs, WAF, DDoS protection
- Identity: RBAC, least privilege, MFA, service accounts
- Data: Encryption at rest (KMS) and in transit (TLS 1.3)
- Application: Secrets management, vulnerability scanning
- Compliance: SOC 2, ISO 27001, GDPR, HIPAA controls