Skills Matrix

A skills matrix maps what a platform engineer can do at each level, from junior through staff, across the competencies that actually matter on a Kubernetes platform.

Use it for hiring calibration, growth conversations, and deciding who is ready to hold production access.

How to Use This List

Read each competency as a ladder, not a checklist - each level assumes everything below it.

Rate honestly against observed behavior, not familiarity. Having read about Karpenter is not the same as having tuned a NodePool during an incident.

Nobody is uniform across all seven competencies, and that is expected. Senior engineers typically sit at senior in four or five and mid in the rest.

The level is the mode, not the maximum. One staff-level spike does not make a staff engineer.

For onboarding, use it to pick the first three gaps to close rather than to grade the whole person.

A - Containers & Image Supply Chain

Junior: Writes a working Dockerfile. Understands layers, COPY vs ADD, and why apt-get update alone busts the cache. Uses docker compose up for local dev.
Mid: Writes multi-stage builds that ship a distroless or minimal runtime stage. Runs as non-root, pins base images by digest, and reads BuildKit cache behavior. Knows Docker builds images while containerd runs them on nodes.
Senior: Owns the org's base images and build cache strategy. Integrates Trivy or Grype scanning with sane severity gates, and cosign signing with verification enforced at admission. Debugs cross-platform builds with buildx.
Staff: Sets supply-chain policy across the org - provenance/SBOM generation, an allow-list of registries, and the deprecation path when a CVE class hits every base image at once.

B - Kubernetes Core Objects & Workloads

Junior: Explains Pod, Deployment, Service, ConfigMap, Secret. Reads kubectl describe output and finds a crash reason.
Mid: Writes correct probes, requests, and limits without copying blindly. Knows why a livenessProbe that duplicates the readiness check causes restart storms, and what a PodDisruptionBudget protects during drains.
Senior: Reasons about scheduling - topology spread, affinity, taints, priority and preemption, QoS classes and eviction order. Chooses StatefulSet vs Deployment on real durability grounds.
Staff: Designs the workload abstractions other teams consume, and decides when a CRD plus controller beats another Helm chart.

C - Networking

Junior: Understands ClusterIP vs NodePort vs LoadBalancer, and that Service DNS is svc.namespace.svc.cluster.local.
Mid: Configures Ingress or Gateway API routes, and writes a default-deny NetworkPolicy plus the allow rules that make an app work again.
Senior: Debugs across the seams - CNI behavior, kube-proxy or eBPF dataplane, DNS latency and ndots, MTU, conntrack exhaustion. Owns Gateway, listeners, and TLS termination.
Staff: Decides mesh vs no mesh, multi-cluster connectivity, and the north-south architecture with its cost and failure model.

D - Reliability & Operations

Junior: Reads logs and events, restarts a Deployment, and rolls back a bad release.
Mid: Diagnoses CrashLoopBackOff, ImagePullBackOff, OOMKilled, and Pending from first principles rather than by pattern-matching. Understands rolling update surge and unavailability.
Senior: Runs incidents. Handles node pressure and eviction, PDB deadlocks during upgrades, and cluster upgrade sequencing including deprecated API migration.
Staff: Owns SLOs and error budgets, drives blameless postmortems into platform changes, and designs the DR story including etcd backup and restore.

E - Security & Policy

Junior: Knows not to run as root, not to bake secrets into images, and not to kubectl apply something they have not read.
Mid: Applies Pod Security Standards at restricted, writes namespace-scoped RBAC, and uses External Secrets rather than hand-managed Secret objects.
Senior: Authors policy-as-code in Kyverno or OPA Gatekeeper, ships it in audit mode first, and understands ServiceAccount token projection and workload identity federation to the cloud IAM.
Staff: Owns the tenancy and trust model, the break-glass path, and the audit story that satisfies compliance without freezing delivery.

F - Delivery & GitOps

Junior: Opens a manifest PR and follows the review feedback.
Mid: Works fluently in Helm and Kustomize, understands Argo CD sync waves and drift detection, and can explain why latest breaks reconciliation.
Senior: Designs the repo topology - app repo vs config repo, environment promotion, secret handling in Git - and runs progressive delivery with canaries and automated rollback.
Staff: Owns the paved path itself: the golden template, the image updater bots, and the change-management contract with app teams.

G - Leadership & Platform Product Sense

Junior: Asks for help early and writes down what they learned.
Mid: Reviews others' manifests usefully and improves the runbook they just used.
Senior: Mentors, sets the review bar, and says no to work that would make the platform a bottleneck.
Staff: Treats the platform as a product with users - measures adoption and friction, sunsets things deliberately, and makes multi-quarter architecture calls that survive contact with reality.

When You Are Done

You should be able to point at any engineer and name their two weakest competencies without hedging.

Each of those gaps should map to a concrete next assignment - not a course, but a piece of real work with a reviewer attached.

You should also see the platform team's collective shape. Seven competencies with only one senior-plus engineer each is a bus-factor problem, not a staffing plan.

If everyone is strong in A through D and weak in E through G, you have an operations team, not a platform team.

FAQs

How often should this be re-scored? Twice a year is enough. Scoring it quarterly turns it into performance theater.

Should app developers be scored on this? No. This is a platform-engineer ladder. App devs need a narrower cut - roughly A, B, and the junior-to-mid rungs of D.

Does a staff engineer need staff-level depth everywhere? No. Staff level is about scope and judgment, typically with two or three deep spikes and credible breadth elsewhere.

Where does cloud expertise fit? Inside each competency rather than beside it - node autoscaling with Karpenter lands in D, workload identity in E, load balancer provisioning in C.

Can this drive compensation? Use it to inform level, not to compute it. A matrix that decides pay gets gamed within one cycle.

What if someone is senior in G but junior in A? That is an engineering manager or an architect, and mislabeling them as a platform engineer helps nobody.

Stack versions: This page was written for Kubernetes 1.36.2, Docker Engine 29.6.1 (BuildKit default), containerd (CRI runtime on nodes), Helm 3, Compose v2, Argo CD (latest - verify at build), and Gateway API (GA - verify controller support at build).

Skills Matrix

A skills matrix maps what a platform engineer can do at each level, from junior through staff, across the competencies that actually matter on a Kubernetes platform.

Use it for hiring calibration, growth conversations, and deciding who is ready to hold production access.

How to Use This List

Read each competency as a ladder, not a checklist - each level assumes everything below it.

Rate honestly against observed behavior, not familiarity. Having read about Karpenter is not the same as having tuned a NodePool during an incident.

Nobody is uniform across all seven competencies, and that is expected. Senior engineers typically sit at senior in four or five and mid in the rest.

The level is the mode, not the maximum. One staff-level spike does not make a staff engineer.

For onboarding, use it to pick the first three gaps to close rather than to grade the whole person.

A - Containers & Image Supply Chain

Junior: Writes a working Dockerfile. Understands layers, COPY vs ADD, and why apt-get update alone busts the cache. Uses docker compose up for local dev.
Mid: Writes multi-stage builds that ship a distroless or minimal runtime stage. Runs as non-root, pins base images by digest, and reads BuildKit cache behavior. Knows Docker builds images while containerd runs them on nodes.
Senior: Owns the org's base images and build cache strategy. Integrates Trivy or Grype scanning with sane severity gates, and cosign signing with verification enforced at admission. Debugs cross-platform builds with buildx.
Staff: Sets supply-chain policy across the org - provenance/SBOM generation, an allow-list of registries, and the deprecation path when a CVE class hits every base image at once.

B - Kubernetes Core Objects & Workloads

Junior: Explains Pod, Deployment, Service, ConfigMap, Secret. Reads kubectl describe output and finds a crash reason.
Mid: Writes correct probes, requests, and limits without copying blindly. Knows why a livenessProbe that duplicates the readiness check causes restart storms, and what a PodDisruptionBudget protects during drains.
Senior: Reasons about scheduling - topology spread, affinity, taints, priority and preemption, QoS classes and eviction order. Chooses StatefulSet vs Deployment on real durability grounds.
Staff: Designs the workload abstractions other teams consume, and decides when a CRD plus controller beats another Helm chart.

C - Networking

Junior: Understands ClusterIP vs NodePort vs LoadBalancer, and that Service DNS is svc.namespace.svc.cluster.local.
Mid: Configures Ingress or Gateway API routes, and writes a default-deny NetworkPolicy plus the allow rules that make an app work again.
Senior: Debugs across the seams - CNI behavior, kube-proxy or eBPF dataplane, DNS latency and ndots, MTU, conntrack exhaustion. Owns Gateway, listeners, and TLS termination.
Staff: Decides mesh vs no mesh, multi-cluster connectivity, and the north-south architecture with its cost and failure model.

D - Reliability & Operations

Junior: Reads logs and events, restarts a Deployment, and rolls back a bad release.
Mid: Diagnoses CrashLoopBackOff, ImagePullBackOff, OOMKilled, and Pending from first principles rather than by pattern-matching. Understands rolling update surge and unavailability.
Senior: Runs incidents. Handles node pressure and eviction, PDB deadlocks during upgrades, and cluster upgrade sequencing including deprecated API migration.
Staff: Owns SLOs and error budgets, drives blameless postmortems into platform changes, and designs the DR story including etcd backup and restore.

E - Security & Policy

Junior: Knows not to run as root, not to bake secrets into images, and not to kubectl apply something they have not read.
Mid: Applies Pod Security Standards at restricted, writes namespace-scoped RBAC, and uses External Secrets rather than hand-managed Secret objects.
Senior: Authors policy-as-code in Kyverno or OPA Gatekeeper, ships it in audit mode first, and understands ServiceAccount token projection and workload identity federation to the cloud IAM.
Staff: Owns the tenancy and trust model, the break-glass path, and the audit story that satisfies compliance without freezing delivery.

F - Delivery & GitOps

Junior: Opens a manifest PR and follows the review feedback.
Mid: Works fluently in Helm and Kustomize, understands Argo CD sync waves and drift detection, and can explain why latest breaks reconciliation.
Senior: Designs the repo topology - app repo vs config repo, environment promotion, secret handling in Git - and runs progressive delivery with canaries and automated rollback.
Staff: Owns the paved path itself: the golden template, the image updater bots, and the change-management contract with app teams.

G - Leadership & Platform Product Sense

Junior: Asks for help early and writes down what they learned.
Mid: Reviews others' manifests usefully and improves the runbook they just used.
Senior: Mentors, sets the review bar, and says no to work that would make the platform a bottleneck.
Staff: Treats the platform as a product with users - measures adoption and friction, sunsets things deliberately, and makes multi-quarter architecture calls that survive contact with reality.

When You Are Done

You should be able to point at any engineer and name their two weakest competencies without hedging.

Each of those gaps should map to a concrete next assignment - not a course, but a piece of real work with a reviewer attached.

You should also see the platform team's collective shape. Seven competencies with only one senior-plus engineer each is a bus-factor problem, not a staffing plan.

If everyone is strong in A through D and weak in E through G, you have an operations team, not a platform team.

FAQs

How often should this be re-scored? Twice a year is enough. Scoring it quarterly turns it into performance theater.

Should app developers be scored on this? No. This is a platform-engineer ladder. App devs need a narrower cut - roughly A, B, and the junior-to-mid rungs of D.

Does a staff engineer need staff-level depth everywhere? No. Staff level is about scope and judgment, typically with two or three deep spikes and credible breadth elsewhere.

Where does cloud expertise fit? Inside each competency rather than beside it - node autoscaling with Karpenter lands in D, workload identity in E, load balancer provisioning in C.

Can this drive compensation? Use it to inform level, not to compute it. A matrix that decides pay gets gamed within one cycle.

What if someone is senior in G but junior in A? That is an engineering manager or an architect, and mislabeling them as a platform engineer helps nobody.

Stack versions: This page was written for Kubernetes 1.36.2, Docker Engine 29.6.1 (BuildKit default), containerd (CRI runtime on nodes), Helm 3, Compose v2, Argo CD (latest - verify at build), and Gateway API (GA - verify controller support at build).

Skills Matrix

Search Documentation

Skills Matrix