Senior PostgreSQL DBA

Senior PostgreSQL DBA

Location: Los Angeles, CA (hybrid)

Contract: 7+ Months

Job Description:

The Senior PostgreSQL DBA owns the design, availability, performance, and security of our production PostgreSQL estate hosted in Microsoft Azure. The role covers both Azure Database for PostgreSQL (flexible server) and self-managed PostgreSQL on Azure virtual machines running Red Hat Enterprise Linux, CentOS Stream, and Windows Server.

This is a hands-on senior engineering role, not a supervisory one. The DBA is the final escalation point for database incidents, the architect of our high-availability and disaster-recovery topology (active-passive and active-active), and the person who keeps us current on PostgreSQL 17, 18, and the upcoming 19 release.

Key responsibilities

Duties marked critical are the core of the role; a candidate who cannot demonstrate them should not advance past the technical screen.

1. High availability and disaster recovery (critical)

Active-passive (primary/standby):

• Design, deploy, and operate zone-redundant high availability on Azure Database for PostgreSQL flexible server: synchronous standby in a second availability zone, automatic failover in 60120 seconds with zero data loss, and the 99.99% uptime SLA that configuration carries.
• Decide between zone-redundant and same-zone (zonal) HA per workload based on latency tolerance and zone-failure risk, and document the trade-off.
• Run and document planned, unplanned, and forced failover tests at least quarterly; measure downtime from the application side, not from the service side.
• Size max_replication_slots and max_wal_senders correctly (four reserved for HA plus one per read replica and per logical slot) so failovers never fail for lack of slots.
• Build equivalent active-passive clusters on self-managed Azure VMs using streaming replication with Patroni and etcd (Linux) or a supported cluster manager on Windows, fronted by HAProxy, PgBouncer, or an Azure internal load balancer.
• Design cross-region disaster recovery: geo-redundant backups, cross-region read replicas, and promotion runbooks with tested RPO/RTO targets.
• Preserve logical replication across failover: pg_failover_slots on PostgreSQL 16 and earlier, native sync_replication_slots = on with hot_standby_feedback = on on PostgreSQL 17 and later.

Active-active (bi-directional / multi-master):

• Design and operate active-active topologies across Azure regions using the pglogical extension or native logical replication, following Microsoft's published bi-directional replication guidance for Azure Database for PostgreSQL.
• Define and enforce conflict-avoidance and conflict-resolution strategy: partitioned write ownership, non-overlapping sequence ranges or UUIDv7 keys, last-writer-wins rules where appropriate, and monitoring for conflict counts.
• Manage DDL propagation across nodes (pglogical.replicate_ddl_command() or controlled DDL rollout for native replication) and sequence synchronization (PostgreSQL 19 adds native sequence replication via ALL SEQUENCES and REFRESH SEQUENCES).
• Monitor replication lag, slot retention, and retain_dead_tuples settings on every node; alert before WAL retention threatens primary disk.
• Own the decision of when active-active is and is not appropriate, and push back on it where a well-run active-passive design meets the requirement at lower risk.

2. Azure platform administration (critical)

• Provision and manage Azure Database for PostgreSQL flexible server via the portal, Azure CLI, Az.PostgreSQLFlexibleServer PowerShell module, ARM/Bicep, Terraform, and REST API.
• Configure networking: VNet integration, private endpoints, private DNS zones, firewall rules, and migration from VNet-injected to private-endpoint servers (now supported for HA-enabled servers).
• Implement Microsoft Entra ID authentication, Entra group login, managed identities, customer-managed keys (including cross-tenant CMK), and SCRAM-SHA-256 as the password default.
• Manage compute and storage tiers, including Premium SSD v2 (GA with HA, read replicas, geo-DR, and major version upgrade support) and online storage scaling.
• Operate built-in PgBouncer (currently 1.25.x) for connection pooling and tune pool modes per application.
• Run in-place major version upgrades on flexible server (PostgreSQL 18 upgrade GA June 2026), including pre-upgrade extension and large-object checks.
• Manage read replicas (in-region, cross-region, cascading), promote them when required, and keep replica lag within SLA.
• Configure backup retention, long-term retention via Azure Backup, point-in-time restore, and recovery of deleted servers; test restores on a schedule.
• Evaluate and deploy elastic clusters (sharded flexible server) for horizontally scaled workloads where appropriate.
• Set custom maintenance windows and coordinate Azure-initiated minor version patching with application owners.

3. Self-managed PostgreSQL on Linux and Windows (critical)

• Install, patch, and tune PostgreSQL 1519 on RHEL 8/9, CentOS Stream, and Windows Server 2019/2022 running as Azure VMs.
• On Linux: manage systemd units, SELinux contexts, firewalld, LVM/managed-disk layout, kernel and huge-page settings, and PGDG repository packaging.
• On Windows: manage the PostgreSQL service, NTFS permissions, Windows Firewall, scheduled tasks for maintenance, and Windows-specific installer and upgrade behavior.
• Operate backup tooling: pgBackRest or Barman on Linux, pg_basebackup and WAL archiving to Azure Blob Storage on both platforms, with incremental backups where supported.

4. Performance engineering

• Diagnose and tune queries using EXPLAIN (ANALYZE, BUFFERS, WAL, IO), pg_stat_statements, auto_explain, and Azure Query Performance Insight.
• Tune autovacuum per table, including PostgreSQL 19 parallel autovacuum (autovacuum_max_parallel_workers) and the new prioritization scoring, and prevent transaction-ID wraparound.
• Reclaim bloat without downtime using REPACK (CONCURRENTLY) on PostgreSQL 19, pg_repack on earlier versions, and VACUUM FULL only as a last resort.
• Tune asynchronous I/O (io_method, worker counts) introduced in PostgreSQL 18, memory parameters, checkpointing, and WAL compression.
• Design partitioning, indexing (B-tree, BRIN, GIN, GiST, skip-scan on PostgreSQL 18), and extended statistics strategies.
• Use pg_plan_advice and pg_stash_advice on PostgreSQL 19 to stabilize problem plans without permanent hints.

5. Security and compliance

• Enforce least-privilege roles, row-level security, and predefined roles (pg_read_all_data, pg_write_all_data); retire MD5 passwords before PostgreSQL 19 begins warning on them.
• Manage TLS, SNI (new in PostgreSQL 19), certificate rotation, and encryption at rest with customer-managed keys.
• Produce audit evidence with pgaudit and Azure Monitor diagnostic logs for SOC 2, HIPAA, or PCI as required.
• Respond to CVEs within the patching SLA and track Azure-applied minor version patches.

6. Monitoring and incident response

• Build dashboards and alerts in Azure Monitor, Log Analytics, and the Azure HA health status monitor; supplement with Prometheus/Grafana or Datadog for VM-hosted clusters.
• Instrument the new PostgreSQL 19 views (pg_stat_recovery, pg_stat_lock, pg_stat_autovacuum_scores) and the per-process-type log_min_messages.
• Lead Sev-1 database incidents, write blameless post-mortems, and drive the resulting fixes to closure.

7. Migrations and upgrades

• Plan and execute migrations into Azure from on-premises or other clouds using Azure Database Migration Service, pg_dump/pg_restore, logical replication, or pg_createsubscriber.
• Lead major version upgrades on both flexible server and VMs, with rollback plans and application regression testing.
• Replace deprecated features ahead of removal: MD5 auth, RADIUS (removed in 19), standard_conforming_strings = off.

8. Automation and engineering practice

• Keep all database infrastructure in code (Terraform, Bicep, Ansible, PowerShell) with CI-tested changes.
• Write runbooks for every failover, restore, and upgrade procedure and keep them current.
• Mentor junior DBAs and developers on PostgreSQL best practices and review schema changes in pull requests.

Required qualifications

All items in this section are must-haves. Azure hosting experience is non-negotiable: candidates whose PostgreSQL experience is only on-premises or on another cloud will not be considered.

Experience

• 7+ years administering PostgreSQL in production, with at least 3 years on PostgreSQL 14 or later.
• 3+ years hosting and operating PostgreSQL in Microsoft Azure, including at least 2 years on Azure Database for PostgreSQL flexible server (not Single Server, which was retired in March 2025).
• Demonstrated ownership of a production active-passive HA cluster, including at least one real (not test) failover.
• Demonstrated design or operation of a production active-active / bi-directional replication topology, with a clear explanation of how conflicts were avoided or resolved.
• Administered PostgreSQL on both Linux (RHEL or CentOS) and Windows Server in production.
• Azure
• Azure Database for PostgreSQL flexible server: HA modes, read replicas, PITR and geo-restore, major version upgrade, server parameters, extensions allow-list, PgBouncer, maintenance windows.
• Azure networking for databases: VNet integration, private endpoints, private DNS, NSGs.
• Microsoft Entra ID authentication for PostgreSQL and managed identities.
• Azure Monitor, Log Analytics (KQL), and Azure Advisor for PostgreSQL.
• Infrastructure as code for Azure: Terraform or Bicep, plus Azure CLI and PowerShell.
• PostgreSQL
• Streaming replication, replication slots, logical replication (publications and subscriptions), and pglogical.
• Patroni or an equivalent cluster manager; etcd or Consul; HAProxy or PgBouncer.
• Backup and recovery with pgBackRest or Barman, WAL archiving to object storage, and incremental backups.
• Deep query tuning: reading execution plans, index design, statistics, partitioning, autovacuum tuning, and bloat management.
• Major version upgrades via pg_upgrade, logical replication, and pg_createsubscriber.
• Working knowledge of PostgreSQL 18 features (asynchronous I/O, UUIDv7, virtual generated columns, temporal constraints, OAuth, data checksums on by default) and awareness of what changes in PostgreSQL 19.
• Operating systems and tooling
• RHEL/CentOS: systemd, SELinux, LVM, package management from the PGDG repository, shell scripting (bash).
• Windows Server: service management, NTFS permissions, PowerShell scripting, Windows-specific PostgreSQL installation and upgrade behavior.
• Git-based workflows, CI/CD pipelines, and configuration management (Ansible preferred).
• Professional
• Experience leading Sev-1 incident response and writing post-mortems.
• Clear written communication: runbooks, architecture decision records, and change requests that non-DBAs can follow.
• Ability to participate in a 24x7 on-call rotation.

Preferred qualifications

• None of these are required, but each one strengthens a candidate's case.
• Microsoft Certified: Azure Database Administrator Associate (DP-300) or Azure Solutions Architect Expert (AZ-305).
• Red Hat Certified System Administrator (RHCSA) or equivalent Linux certification.
• Hands-on testing of PostgreSQL 19 betas or release candidates, especially REPACK CONCURRENTLY, parallel autovacuum, WAIT FOR LSN, and sequence replication.
• Experience with Azure Database for PostgreSQL elastic clusters (Citus-based sharding) or with Citus on self-managed clusters.
• Experience with EDB Postgres Distributed, pgEdge, or another commercial multi-master product, with a clear view of what native tooling can and cannot replace.
• Experience with Azure Database Migration Service for online migrations from Oracle, SQL Server, or other PostgreSQL sources.
• Experience operating pgvector, pg_diskann, or Apache AGE on flexible server for AI or graph workloads.
• Kubernetes-hosted PostgreSQL on AKS using CloudNativePG, Crunchy Postgres Operator, or Zalando Postgres Operator.
• Contributions to the PostgreSQL community: patches, extensions, conference talks, or documentation.
• Familiarity with Oracle, SQL Server, or MySQL for cross-platform migration work.
• Security and compliance background: SOC 2, HIPAA, PCI DSS, or FedRAMP audits involving database controls.
• Ability to work in the U.S. without sponsorship
• Ability to meet the location requirement outlined above

Pay Transparency: "The expected pay range for this position is $68.00-$70.00 per hour. Final compensation will be determined based on experience, skills, and qualifications. Non-exempt employees are eligible for overtime. Full-time employees are eligible to select from different benefits packages. Packages may include medical, 401(k) without employer match. Paid Sick leave is provided based on state or local laws."