Senior CheckMK & Grafana Engineer

Project overview

Project opportunity

• Location: Hybrid. Remote on Mondays and Fridays, onsite in Berlin or Bonn Tuesday to Thursday
• Security: Nationality must be on the approved list; Ü2 security clearance required
• Start and duration: Full-time from 1 or 15 November, for at least 1 year

Responsibilities

Required qualifications

CheckMK

Grafana

InfluxDB / TSDB

Requirements management and design

BSI IT-Grundschutz and security

Automation and infrastructure

Required project references

Completed projects that show:

• Gather and assess business, technical and security requirements for a central monitoring platform (metrics, logs, events, alerting, dashboards, KPIs). Evaluate feasibility, risks, dependencies and effort.
• Turn requirements into solution designs and work packages with scope, dependencies, deliverables and acceptance criteria. Set priorities with the infrastructure, security and operations teams.
• Design, build and migrate a highly available, geo-redundant CheckMK Enterprise environment. This includes distributed monitoring, remote sites, and replacing the current system with cutover and rollback plans.
• Design, migrate and develop a geo-redundant Grafana environment: dashboards, data sources, alerting, notifications and RBAC.
• Integrate and run InfluxDB for long-term storage, retention and historical analysis. Build an end-to-end CheckMK–InfluxDB–Grafana solution.
• Define plans for HA, failover, backup/restore and DR.
• Build interfaces to ITSM/ticketing, CMDB, LDAP/AD, SSO, email/notifications, and network, server and application environments.
• Automate deployment and operations with Ansible and IaC.
• Apply BSI IT-Grundschutz at every stage: hardening, access control, authentication, TLS/PKI, logging, patch and vulnerability management, and backup.
• Run and document functional, integration, migration, failover, recovery, load and security tests. Support acceptance.
• Write architecture, migration and test plans, interface documentation, runbooks, operations manuals and BSI evidence.
• Lead a structured handover and knowledge transfer so the operations team can run the platform.
• Several years of hands-on CheckMK Enterprise experience, designing, building, migrating and running complex environments
• Distributed monitoring, remote sites, HA and geo-redundancy
• Custom checks and plugins, rulesets and notifications; agent-based monitoring, SNMP, REST API and automated configuration
• Replacing older monitoring systems, including parallel running, cutover and rollback
• Several years in production enterprise environments; designing HA or geo-redundant setups, failover and DR
• Dashboards, data sources and queries, alerting and notifications, RBAC, provisioning, HTTP API
• Production experience: Grafana integration, data modelling, retention, performance and capacity planning, backup/restore, InfluxQL and/or Flux
• Analysing complex requirements and turning them into solution designs and work packages
• Spotting dependencies, risks and prerequisites; estimating effort, setting priorities and writing acceptance criteria
• Working with security, architecture, infrastructure and operations teams; designing interfaces to ITSM, CMDB, directory and notification systems
• Strong practical knowledge of BSI IT-Grundschutz; identifying the relevant modules and applying the measures to infrastructure and platforms
• Hardening, IAM/RBAC, TLS/PKI, logging, patch and vulnerability management, backup/recovery
• Audit-ready security documentation and evidence
• Public-sector or regulated experience is a plus
• Very good Ansible skills (playbooks, roles, templates, inventories, variables); idempotent automation of CheckMK, Grafana and InfluxDB
• IaC/CaC, Git, CI/CD, code reviews, secrets management
• Strong Linux (Debian/Ubuntu and/or RHEL); TCP/IP, DNS, HTTP(S), SNMP, REST
• Python, Bash; load balancers, reverse proxies, certificate management
• CheckMK Enterprise: architecture, migration, and a distributed and/or HA geo-redundant setup
• Grafana: architecture, migration, and an HA or geo-redundant setup
• InfluxDB/TSDB: integration and production operations in a monitoring architecture
• Ansible: automated deployment of similar platforms
• BSI IT-Grundschutz: hands-on use in an infrastructure or monitoring project
• Requirements management: turning complex requirements into plans and work packages

Nice to have

Personal skills

• Prometheus/OpenMetrics, Grafana Loki or central log monitoring
• LDAP/AD, SSO
• Docker, Podman or Kubernetes
• ITIL and operational handover
• Analytical and structured, with strong ownership and focus on quality
• Explains complex topics clearly and runs structured knowledge transfer
• Works well in mixed teams; Scrum/Kanban experience is a plus

Project details

• Start: ab sofort
• Remote: hybrid
• Location: Berlin, Deutschland, DE