In this guide 6 sections
Hire a full time DevOps engineer when you release often and the pipeline needs daily care. Retain a consultant when work arrives in bursts. Buy a one off setup when little is automated and a developer can own the result afterwards.
Start from how often you release
A team that ships several times a day produces constant small work: red builds in GitHub Actions, expiring TLS certificates, slow test stages, pager alerts at night. That work suits a permanent person who knows the system. Hire.
A team that ships every few weeks has long quiet gaps, and a full time salary sits idle between them. The work is real but lumpy. A retainer fits better.
Count your releases over the last quarter. Then count the hours lost to manual deploy steps, such as copying a build to the server or editing a config by hand. Those two numbers tell you more than any job title.
- Releases per month
- Hours spent on manual deploy steps
- Incidents caused by release mistakes
- Environments to keep running
Look at what is already automated
If builds, tests and deploys already run from a pipeline, you need someone to tend it. If a developer still copies files over SSH on release night, you need someone to build it first.
Building is project work with a start and an end. Tending never ends. Teams that mix them up hire a permanent engineer for a six week job, or expect a consultant to carry the pager forever.
Write down every step from commit to live users, from the pull request to the DNS record. Mark each step as scripted or by hand. The hand steps are your backlog.
Compare the three options side by side
A full time hire gives you context, availability and a person who grows with the system. The cost is salary, recruiting time, and a single point of failure whenever they take leave or resign.
A retained consultant brings senior judgement for a few days a month, plus cover for design reviews and incidents. They know less about daily quirks. A one off project delivers a working pipeline, Terraform files, documentation and a handover. Nothing follows.
Hybrids are common. Many companies buy the setup, keep a small retainer for upgrades and on-call help, then hire once volume justifies a seat.
- Full time: context and daily ownership
- Retainer: senior advice, flexible hours
- Setup project: fixed scope, clean handover
- Hybrid: setup now, retainer after
Ask who owns the pipeline after the first changes ship
This question decides most cases. After the first round of changes ships, someone must fix the build that breaks on a Tuesday afternoon while the original engineer is on another client. If nobody inside the company can, you have rented a dependency.
Insist on a runbook, pipeline files in your own repository and credentials in your own cloud account. Pair one of your developers with whoever does the work. Knowledge then stays in the building.
A good consultant becomes less needed over time. Be wary of one who does not.
Make the call with a short trial
Run a four week pilot with one goal, such as a one-click deploy to staging with automatic tests and a Slack message on failure. Judge it on what shipped and how well it was written up.
Then decide. If the work kept growing, hire. If it ended cleanly, keep a retainer. If your developers now manage it themselves, stop.
Put the pilot goal in writing this week. Ask each candidate how they would meet it.
DevOps staffing decision sheet
A one-page scoring grid with three columns for hire, retainer and setup project. Rows cover release count per month, manual steps left, on-call needs, budget range, handover plan, pipeline owner at six months and the pilot goal. Rate each cell on a scale of one to five.
Open a blank worksheet to printQuestions owners ask
When is a full time DevOps engineer worth it?
When releases are frequent, several environments need care and incidents need a quick, informed response. If the work fills most of a week, every week, hiring makes sense. Otherwise it does not.
Can a consultant replace an in-house engineer?
For a while, yes. For daily on-call duty and deep product knowledge, usually not. A retainer works best when your developers handle routine tasks and the consultant handles design, reviews and upgrades.
What should a handover include?
Pipeline files in your repository, a runbook, access in your own accounts, an architecture sketch and a recorded walkthrough. Ask for a rehearsed rollback too.
What if we have no automation at all?
Begin with a one off setup covering builds, tests and a staging deploy. Reassess after a month. By then you can see how much ongoing work remains.