Senior DevOps Engineer

Onto Innovation is a leader in process control, combining global scale with an expanded portfolio of leading-edge technologies that include: 3D metrology spanning the chip from nanometer-scale transistors to micron-level die-interconnects; macro defect inspection of wafers and packages; metal interconnect composition; factory analytics; and lithography for advanced semiconductor packaging. Our breadth of offerings across the entire semiconductor value chain helps our customers solve their most difficult yield, device performance, quality, and reliability issues. Onto Innovation strives to optimize customers’ critical path of progress by making them smarter, faster and more efficient.

Job Summary & Responsibilities

Role Summary

If you like the idea of being the person who owns the GitHub platform for a large, modern Windows product organization, designing the runners, container images, workflows, and release plumbing that everyone else builds on, this role is for you. You will be joining a sharp, tight-knit engineering organization that shares knowledge generously, challenges each other in good faith, and has a lot of fun solving hard problems together. The role fills a specific gap in our coverage: the person who takes it will both lean on the team and make the team better.

The portfolio is primarily C# on .NET (the range from .NET Framework 4.8 through .NET 9, plus .NET Standard 2.0 shared libraries) and significant C++ on Windows, all in git on GitHub Enterprise. You own the GitHub side of the platform (runners, container images, Actions workflows, signing, release plumbing) so product teams can build, test, sign, package, and ship cleanly. Teams own the contents of their builds; you own that the path exists, is fast, and works.

This is a Copilot-augmented role, focused on cloud GitHub Copilot on GitHub itself (PR review and summarization, Copilot in Actions, custom Copilot skills and agents). IDE Copilot in Visual Studio and VS Code is what product teams use; you enable and govern it. Conceptual depth beats tenure with any single toolchain: you should understand why an approach is correct and recognize when a Copilot, Stack Overflow, or vendor answer is wrong.

Responsibilities

Platform: build, test, sign, and ship

• Design and maintain shared GitHub Actions CI/CD (reusable workflows, composite actions, matrix builds) that product teams compose into their own pipelines, with first-class C# / MSBuild / .NET and C++ / vcpkg / CMake build paths.

• Own the NuGet story end-to-end: internal feed, large internal package artifacts, versioning, retention, and CI restore performance.

• Design and operate the runner fleet: cloud-hosted Windows-first (plus Linux) VMs running containerized CI/CD jobs from custom images (Packer / Azure Image Builder), including a GPU-passthrough image. Pick the right orchestrator for the workload, keep toolchains pinned and reproducible, and own the operational details (driver / CUDA pinning, runner registration, ephemeral vs warm pools).

• Own packaging, signing, and release plumbing: WiX (v4 / v5+) MSI templates, NuGet packaging, Authenticode signing (HSM / cloud signing), SemVer / changelog automation, install / upgrade scaffolding.

• Provide the test integration surface in CI (VSTest / MSTest / NUnit / xUnit for .NET, plus the C++ test frameworks in use, including hardware-in-the-loop where applicable).

• Build automation and observability tooling (Python, PowerShell, Bash) and manage the runner and image fleet as infrastructure as code so it is reproducible, reviewable, and auditable. Tool choice is open; propose the right one when the need is real.

Security and operations

• Drive supply-chain security: signed commits, Authenticode for Windows binaries (Sigstore / cosign for containers), SBOMs, Dependabot / CodeQL / Trivy, OIDC to cloud, and secret / cert lifecycle.

• Operate the platform as a product: SLOs (pipeline success, queue time, build duration), disaster recovery for runners / registry / NuGet feed / secrets / IaC state, and audit evidence.

• Hold an on-call rotation, lead blameless post-mortems, track DORA metrics, and eliminate CI/CD bottlenecks.

Partnership with engineering

• Act as the in-house GitHub subject-matter expert and first responder for broken pipelines. Triage in a blameless way: separate platform issues (runner, image, workflow, signing, NuGet feed) from code issues (MSBuild / linker / test failures); fix the former, file clean tickets for the latter with logs, repro, and suspected cause.

• Embed with product teams to unblock releases, run office hours, and treat runbooks and documentation as first-class deliverables.

Success Looks Like

• 90 days: ramped on the inherited platform and on-call; comfortable adding runner instances and onboarding additional repositories; first targeted improvements shipped.

• 6 months: SLOs tracked; signed, reproducible MSI builds on every release branch; cloud-hosted, containerized runners (including the GPU-passthrough image) carrying production CI load; NuGet feed and signing baseline maintained; runbooks for top incidents in place.

• 12 months: measurable DORA improvement; build times and flake rates trending down; platform cost visibility; common DevOps tasks self-served by engineering teams; platform evolved beyond its initial scope where it makes sense.

Why You Will Like It Here

• Real ownership, shared with the team. You are the recognized owner of the GitHub side of the platform (not a ticket queue, not a consultant), and you make the architectural calls with the DevOps team. Every voice carries weight, decisions are made together, and you have real backing when you take one on.

• A team that makes each other better. Sharp, tight-knit group that shares knowledge openly, asks each other hard questions, and grows together. Learning on the job is the norm; you are not expected to know everything on day one.

• Blameless, collaborative culture. Triage is about fixing the problem, not finding someone to blame. People here genuinely enjoy the work and each other. Travel stays light (up to 5 percent).

Qualifications

Required Qualifications

Strong coverage of most below; missing one or two is fine if you bring the fundamentals.

• BS in Computer Science or equivalent practical experience, with 3+ years in DevOps / SRE in production.

• Demonstrated ownership of CI/CD at scale, ideally GitHub Actions with cloud-hosted VM runners built from custom images (Packer / Azure Image Builder / EC2 Image Builder) and OIDC to cloud. Experience with GPU-enabled cloud VMs and GPU passthrough for test workloads.

• Working knowledge of C#, MSBuild, NuGet, and .NET across the range used here (.NET Framework 4.8 through .NET 9, plus .NET Standard 2.0), including internal NuGet feeds and large package artifacts, and of C++ on Windows (.vcxproj, MSVC, vcpkg / CMake). Comfortable extending .NET builds to Linux.

• Comfortable producing high-quality Python, PowerShell, Bash, and YAML with Copilot assistance, with enough underlying depth to tell when the generated code is right and when it is subtly wrong.

• Practical Windows Server administration and working Linux competence; strong with containers for CI/CD workloads and able to pick the right orchestrator.

• Proficiency with Git and GitHub as a platform (PRs, branch protection, CODEOWNERS, environments, GHCR, REST / GraphQL APIs).

• IaC with Terraform or Pulumi via PR workflow; observability with Prometheus, Grafana, OpenTelemetry, or equivalent.

• Supply-chain and platform security: Authenticode for Windows binaries, secret management (Vault / cloud KMS), image signing, SBOMs, SAST / DAST in pipelines.

• Hands-on GitHub Copilot on GitHub (PR review, Copilot in Actions, Copilot Chat in the GitHub UI), including building custom Copilot skills / agents for PR code review, unit-test coverage validation, and house-style enforcement.

Preferred / Optional Skills

• WiX Toolset (v4+): nice-to-have; able to partner with developers on MSI / installer issues.

• Experience standing up a CI/CD or platform-engineering practice and documenting decisions as ADRs.

• GPU-accelerated containers on NVIDIA hardware (NVIDIA Container Toolkit, GPU Operator, CUDA base images, MIG, driver / CUDA pinning).

Why Join Onto Innovation?

At Onto Innovation, we believe your work should matter—and so should your well-being. That’s why we offer competitive salaries and a comprehensive benefits package designed to support you and your family. From health, dental, and vision coverage to life and disability insurance, PTO, and a 401(k) with employer match, we’ve got you covered. You’ll also enjoy access to our Employee Stock Purchase Program (ESPP), wellness initiatives, and cutting-edge tools—all within a collaborative, inclusive culture where your contributions are valued and recognized.

Compensation & Growth

• Base Salary Range:

• Additional Rewards: Annual bonus opportunities and potential long-term incentives tied to both company and individual success.

Empowering Every Voice to Shape the Future:

Onto Innovation is committed to creating a workplace where every qualified candidate has an equal opportunity to succeed. We evaluate applicants based on skills, experience, and potential - without regard to race, color, religion, gender, sexual orientation, national origin, age, disability, veteran status, or any other characteristic protected by law. We believe diversity of thought and background drives innovation and strengthens our team.

Important Note on Export Compliance

For certain positions requiring access to technical data, U.S. export licensing review may be necessary for applicants who are not U.S. Citizens, Permanent Residents, or other protected persons under 8 U.S.C. 1324b(a)(3).