CertQuests
From junior DevOps to senior DevOps in 18 months.
Junior to senior DevOps in 18 months is mostly about evidence, not certificates. Senior-DevOps levelling rubrics at most companies want three things on top of the obvious technical depth: you can own an incident end-to-end without a senior copilot, you have built something a peer team relies on in production, and you have raised a junior past their probation. The cert sequence (CKA → AWS SAP-C02 → Terraform Associate) is the spine; the artifacts (a platform module other teams import, a published post-mortem catalogue, one mentored junior) are the load-bearing structure. Salary delta is +$50–90k base, sustained.
The two failure modes are (1) collecting certs without ever putting your name on a production system other people depend on, and (2) waiting for promotion from within when the market would pay 30% more for a lateral. The plan below is built to defeat both.
Why this climb is harder than the entry pivot
The junior-DevOps job market in 2026 is healthy — the U.S. Bureau of Labor Statistics tracks computer-and-information-systems roles at a 2024 median wage of $169,510 and 17% projected growth through 2033, with DevOps/SRE titles indexing above that median. But the climb from junior to senior is steeper than the climb in. Junior DevOps means “reliably executes within a system someone else built.” Senior DevOps means “owns the system, including the parts nobody told you to build.” The promotion gap is closed by track record, not coursework.
That is why this roadmap is 18 months, not 12. The certs are the easy half — they slot into evenings and weekends like any other phase. The hard half is convincing your manager, your skip-level, and (eventually) an external hiring panel that you operate at senior altitude. Three artifacts close that gap reliably: a Terraform module another team imports without you in the room, a post-mortem catalogue that shows you led the incident review rather than took notes, and a junior who shipped under your mentorship. None of those exist as a certificate. All of them count more than a certificate when the levelling committee sits down.
The 18-month sequence
Three phases of six months. Each phase has one cert plus one artifact that survives outside your current employer — meaning a public repo, a published write-up, or a documented production system you can describe in an interview without breaking NDA. Skip either side and the phase does not count.
Months 1–6 — Kubernetes depth + on-call ownership (CKA)
- Cert: Linux Foundation CKA ($445, ~120 study hours, ~60% first-attempt pass rate). The single highest-signal credential in the DevOps stack and the one that converts “I run
kubectl” into “I understand the cluster.” Even if you operate Kubernetes daily, the prep forces breadth on etcd backup-restore, kubeadm bootstrap, RBAC + admission, and the failure modes you have never seen because production runs fine. - Artifact: own the next three production incidents on your team end-to-end — page, mitigate, root-cause, write the post-mortem, present it at the review. Start a private repo of those post-mortems (scrub the company specifics; keep the timelines, decisions, and learnings). By month 6 you should have three; by month 18 you should have seven. This becomes interview material no certificate can substitute.
- Coding: 2 hours/week of Go reading-fluency — A Tour of Go in month 1, then read one CNCF tool's source (kubectl, k9s, or a small operator) for 30 minutes per week. By end of phase 1 you should be able to follow a Kubernetes controller-runtime PR without panicking. Senior DevOps interviews increasingly include a “walk me through a Go bug you debugged” round.
- Mentorship: start mentoring whoever is six months behind you on the team — pair on tickets, review their PRs, write the runbooks you wish someone had handed you. Senior-DevOps levelling rubrics weight this heavily; managers cannot fake-promote you past it.
Months 7–12 — Architecture altitude (AWS SAP-C02 or AZ-305 or GCP PCA)
- Cert: AWS Solutions Architect Professional SAP-C02 ($300, ~150 study hours, ~50% first-attempt pass rate) — or AZ-305 / Google PCA if your shop is Azure / GCP. This is the credential that flips the recruiter algorithm from “DevOps Engineer” pings to “Senior DevOps” and “Staff Platform Engineer” pings. SAP-C02 also closes the gap between “I can use AWS” and “I can argue about AWS at a design review.”
- Artifact: a published Terraform module another team in your company (or open source) actually imports — multi-AZ RDS with parameter-group baseline, an EKS module with cluster-autoscaler + Karpenter + the standard add-ons, or a CI/CD bootstrapper module. Publish it on the internal registry or GitHub. The acceptance test is non-trivial: another engineer imports your module without asking you a question. That is the senior-DevOps gate behavior, encoded.
- The burnout month is month 9. Most junior-DevOps candidates hit the wall when SAP-C02 review questions, the on-call rotation, and the “I should have shipped that module already” guilt collide. Plan a one-week pause around week 36; come back to whichever of the three is most past-due. Do not start phase 3 until phase 2's module has at least one external consumer.
- Conferences and writing: submit a CFP to KubeCon, HashiConf, AWS re:Invent, or a regional DevOps Days. Even rejection is signal — the abstract becomes a blog post, the blog post becomes a portfolio bullet. If accepted, the talk is the single highest-value piece of evidence in your senior-DevOps application.
Months 13–18 — Platform thinking + the offer (Terraform Associate + interview)
- Cert: HashiCorp Terraform Associate 003 ($70.50, ~50 study hours, ~75% first-attempt pass). Cheapest credential in the sequence; the one that proves you have systematised the declarative-state work you have been doing in phase 2. Pair it with a deliberate Terraform refactor of one legacy stack at your company — not greenfield, refactor — so you can interview on the migration story.
- Artifact: a published write-up of the internal developer platform (IDP) you have helped build — either a blog post or an internal RFC, scrubbed for NDA — that explains the golden path your platform offers application teams, the abstractions you exposed (Backstage templates, ArgoCD app-of-apps, Crossplane compositions), and what you said no to and why. This is the artifact that distinguishes “senior DevOps” from “senior platform engineer” offers, which pay $5–15k higher in 2026.
- Promotion or pivot, month 15 onward. Sit down with your manager month 13 with a written case for senior promotion — the three certs, the post-mortem catalogue, the published module, the mentee, the IDP write-up. If the answer is “not this cycle,” treat that as a forward-looking offer-decline and start interviewing externally month 15. 4–6 applications per week, targeting peer-stage companies (Series C–E SaaS, mid-stage fintech, regional MSPs running multi-tenant Kubernetes). Most senior offers come from outside, not within.
- Salary anchor: $160–195k base in mid-cost US metros, $185–235k coastal/tech-heavy, per Levels.fyi DevOps Engineer data, May 2026. UK / EU: £90–130k senior DevOps per CW Jobs and Hays May 2026 surveys. Below $145k base in a US metro means the title is “senior” on paper only — negotiate or walk.
The investment math
Cash outlay: CKA $445 + AWS SAP-C02 $300 + Terraform Associate $70.50 = $815.50 in exam fees, plus $25–45/month for KodeKloud or A Cloud Guru or Tutorial Dojo ($540 over 18 months), plus $40–80/month in AWS / homelab cluster costs ($1,080 over 18 months). Round to $2,400 hard cash. Time investment is roughly 600 focused hours. At a $45/hour junior-DevOps opportunity cost, total investment lands near $29,400.
Expected return: a $50–90k base salary increase (call it $68k median), sustained, with 10–20% bonus typical at senior level and equity at venture-backed shops typically adding another $20–60k/year on top. Payback is roughly 6–9 months after starting the senior role. Five-year cumulative delta usually clears $420,000 before counting the typical Senior → Staff promotion at year 3–4, which lands at $200–260k base in most metros.
What separates seniors from juniors (the unwritten part)
None of these show up on a job description, all of them show up on a levelling rubric:
- You explain trade-offs, not preferences. “We chose ArgoCD because GitOps fits our team's PR-review culture and we accept the cost of a longer reconciliation loop” is senior. “ArgoCD is better than Flux” is junior. Practice this until it is reflex — the AWS SAP-C02 review questions are excellent training material because every answer is a trade-off statement.
- You write the runbook before you need it. Junior DevOps writes the post-mortem after the outage. Senior DevOps writes the runbook before the outage and the post-mortem is shorter as a result. The discipline shows on a resume as “reduced MTTR from 47 minutes to 11 minutes by codifying L1 response in runbooks.”
- You take on-call seriously and visibly. Volunteer for primary on a high-page service; lead the on-call rotation rebalancing if it is broken; publish the on-call health metrics. Senior-DevOps hiring panels ask “tell me about your worst week on-call” specifically to filter people who have not really been the buck-stops-here.
- You raise a junior. The single hardest-to-fake senior signal. Pair on tickets, review PRs in detail, write the docs you wish you had. Their probation success becomes your interview material (anonymised).
- You operate cost. Cloud bills are the most-skipped senior-DevOps skill. Read your team's AWS Cost Explorer monthly, propose one cost-reduction quarterly, measure it. A “reduced EKS spend 18% via right-sizing + Karpenter + Savings Plan” bullet outperforms two certs.
When to deviate from the plan
- You target SRE, not DevOps. Replace AWS SAP-C02 with Google's Professional Cloud Architect plus the Google SRE book on a 6-week study plan. SRE roles index higher on Linux, error budgets, and incident management; lower on the “ship features for app teams” muscle. Pay is similar, the daily texture is different.
- You target platform engineer explicitly. Keep phase 1 and phase 2; in phase 3 add a Backstage or Crossplane deep-dive in place of the Terraform Associate (which you may already have). Platform engineer postings in 2026 weight IDP experience above declarative-IaC certs.
- Your shop runs Azure, not AWS. Translate: AWS SAP-C02 becomes AZ-305, and add AZ-700 (networking) in phase 3 in place of the Terraform Associate if you are heavy on hub-spoke / Virtual WAN work. Terraform stays relevant either way.
- Your shop runs GCP. Replace AWS SAP-C02 with Google Professional Cloud Architect, add Professional Cloud DevOps Engineer in phase 3 in place of Terraform Associate if your IaC story is heavy Config Controller / Config Connector.
- You hate Kubernetes. The honest answer is the senior-DevOps market has consolidated around it — only ~5% of senior postings in 2026 are Kubernetes-free, and those are mostly legacy-bank Linux / VMware shops. If you genuinely cannot reconcile, target SRE at a non-Kubernetes shop (HashiCorp Nomad, ECS-only, bare-metal Linux) and lean hard on Terraform + observability instead.
Bottom line
Junior to senior DevOps in 18 months is achievable specifically because the senior bar is mostly about production evidence and the certs are the scaffolding around that evidence. Three certs (CKA, AWS SAP-C02 or equivalent, Terraform Associate), three artifacts (post-mortem catalogue, imported module, IDP write-up), one mentee, three phases. The candidates who finish are the ones who refuse to skip the “another team imports my module” gate and the “raised a junior past probation” signal — both of which require six months of patience that no Udemy course shortcuts. The ones who do not finish almost always stall on month 9 (the burnout trough) or wait for a promotion-from-within that was never going to come and never look outside. Plan for both.
Start phase 1 right now — no signup
CertQuests has engineer-written practice questions for the CKA, AWS SAP-C02, and Terraform Associate with full explanations on every answer. Free, no account required.
Frequently asked questions
Why 18 months and not 12?
Because the gap between junior DevOps and senior DevOps is not three more certs — it is a working production track record. The CKA, AWS SAP-C02, and Terraform Associate are the easy half of the climb; the hard half is owning an incident from page to post-mortem, building a platform that another team relies on, and mentoring a junior into competence. Twelve months gets you the certs. Eighteen months gets you the title, the offer, and the levelling rubric ticked off.
Can I skip the AWS SAP-C02 if my shop runs Azure or GCP?
Yes — substitute the corresponding architect cert (AZ-305 for Azure shops, Google Professional Cloud Architect for GCP shops). The promotion-relevant signal is “I can think above the resource level — landing zones, network topology, multi-account governance, cost-allocation,” not the specific provider. Pick whichever your employer uses; expense reimbursement is usually conditional on the matching vendor.
What if my company will not promote me regardless of what I do?
Then this plan is your exit plan. Senior DevOps offers at peer companies in 2026 cluster at $160–200k base in mid-cost US metros and $190–240k coastal/tech-heavy, per Levels.fyi May 2026 data. The artifacts on your GitHub (platform module, terraform-module-* repo, post-mortems repo) carry across employers; the cert badges count externally too. Most senior-DevOps offers come from outside, not from within — promotion-from-within at the same company is the exception, not the rule.
Do I need to learn Go?
Increasingly yes. Senior DevOps interviews in 2026 routinely include either “write a small CLI” or “walk through a Go service you debugged” — because Kubernetes, Terraform providers, and most CNCF tooling are Go. Python remains the lingua franca for glue scripts, but Go reading-fluency is what separates senior-DevOps from senior-DevOps-pretending. Spend 40–60 hours over the 18 months: A Tour of Go, then write one CLI that talks to the Kubernetes API.
Is the CKA still worth it in 2026 if I already run Kubernetes daily?
Yes — the credential closes a perception gap on resumes that “I run kubectl every day” cannot close. Hiring managers cannot verify your day-to-day; they can verify the badge. CKA also forces breadth on the topics you skip in production (etcd backup-restore, kubeadm cluster bootstrap, hardening with Pod Security Standards). Most candidates who pass say it sharpened their incident-response speed, not their kubectl muscle.
Should I switch to platform engineering instead?
If your company has an explicit platform team and a published internal developer platform (IDP), yes — senior platform engineer salaries in 2026 sit $5–15k above senior DevOps in the same metro, per Levels.fyi. If platform is not a team and not a budget line, “platform engineer” is just senior DevOps with a different business card. Optimise for the artifact (a real IDP that another team uses) rather than the title.
How we wrote this
No bootcamp or training-vendor revenue. Salary anchors come from the BLS Occupational Outlook Handbook (broader computer-and-information-systems bucket, 2024 median $169,510) cross-referenced against Senior DevOps Engineer postings on LinkedIn and Indeed and self-reported offers on Levels.fyi as of Q2 2026. CKA and AWS SAP-C02 cost / curriculum reflect the official Linux Foundation CKA and AWS Solutions Architect Professional pages as of June 2026. Terraform Associate cost reflects the HashiCorp store list price. Investment math uses a $45/hour junior-DevOps opportunity cost. The 18-month timeline reflects observed promotions and lateral moves in the CertQuests community over 2024–2026; faster timelines exist but are not the median. Tell us what you’d update.
Last reviewed: June 4, 2026.