Lead Infrastructure Engineer - Platform & Kubernetes

About the role

We are looking for a hands-on Lead Infrastructure Engineer to build and own the infrastructure for Rojo's new integration products. You will be our first infrastructure hire and will be responsible for the Kubernetes platform, infrastructure as code, messaging, identity, secrets, security and observability.

This is a greenfield build with no legacy systems to work around, so the decisions you make early on will shape the platform for years to come. In the first phase you will be closely involved in the day-to-day work, from writing Terraform and setting up clusters to troubleshooting Kafka. As the product grows, you will build and lead the infrastructure team.

The platform needs to support the following from day one:

• Security: Least-privilege access, encryption in transit and at rest, secrets management and audit logging built in from the start rather than added later.

• Tenant Isolation: Namespace-per-tenant, default-deny network policy, per-tenant secrets, and identity realms.

• Hybrid & On-Prem Deployment: Hosting central control planes in the cloud while supporting deployment across on-premises or private cloud customer environments.

• Durability & Messaging: Kafka as the backbone for event-driven components.

• EU Data Sovereignty: Region, encryption, audit trails, and self-hosted vs. managed choices that hold up under GDPR and EU AI Act rules.

• Observability: Every span, log, and metric traceable per tenant across all deployed environments.

Who we are looking for

Someone who has built infrastructure from the ground up and owned it in production, whether at a startup, a new product team within a larger organisation, or a venture of their own. You are comfortable making architecture decisions without a detailed roadmap, can explain the trade-offs behind them, and enjoy doing the hands-on work yourself.

This role suits someone who wants broad ownership more than someone looking for a narrowly defined scope within a large platform team.

Must-haves

• Experience: 6+ years in infrastructure, platform or SRE roles, including at least one role where you built or rebuilt production infrastructure from the ground up and were responsible for running it.

• Kubernetes (Managed & On-Prem): Strong production experience, including multi-tenant isolation (namespaces, NetworkPolicy, ResourceQuota/LimitRange, Pod Security Admission) and autoscaling. Experience with a managed service (EKS, GKE or AKS) as well as a self-hosted or on-prem distribution (e.g., K3s, Rancher, OpenShift).

• Hybrid Networking & Connectivity: Experience setting up secure connectivity between cloud control planes and customer-hosted environments (e.g., mTLS, WireGuard/VPN, reverse proxies).

• Infrastructure as Code: Modular design, remote state with locking, and state-splitting to limit blast radius. Terraform preferred; experience with OpenTofu, Pulumi or Crossplane is also relevant.

• Distributed Messaging: Production experience running a messaging system, including sizing, replication, DLQ and retry handling. Kafka preferred (KRaft is a plus); strong experience with Pulsar, RabbitMQ or NATS is also relevant.

• Security: A solid understanding of infrastructure and cloud security, including least-privilege IAM and RBAC, network segmentation, encryption in transit and at rest, container and image hardening, and secrets management (e.g., Vault) with OIDC-based identity (e.g., Keycloak). Familiarity with frameworks such as ISO 27001, SOC 2 or GDPR is a plus.

• Leadership & Independence: Experience setting technical direction, documenting and defending architecture decisions, and prioritising work without a predefined roadmap.

What you will own

• Identity and secrets: per-tenant identity patterns and Kubernetes-native secrets management, with no hardcoded secrets.

• CI/CD: pipelines (e.g., GitHub Actions) with OIDC-based cloud authentication and secret scanning.

• Observability: tenant-aware metrics, logs and traces across hybrid environments (OpenTelemetry, Prometheus, Loki, Tempo).

• Compliance: the EU data-sovereignty setup, covering regions, encryption, audit trails, GDPR and the EU AI Act.

Hands-on experience with all of these is not required from day one, but you should be able to take ownership of them.

Nice-to-haves

• GitOps Patterns: Experience with multi-cluster management and GitOps workflows (e.g., ArgoCD, Flux) for deploying and maintaining workloads across multi-region or on-prem environments.

• Multi-tenant Regulated SaaS: Experience with compliance (finserv, healthcare, public sector), data residency, audit logging, and encryption-at-rest requirements.

• Integration/ESB Runtimes: Familiarity with engines like Apache Camel or durable-execution/workflow orchestration engines (e.g., Temporal.io).

• API Gateways: Rate limiting, mTLS termination, per-tenant quotas.

• AI/LLM Infrastructure: Basic familiarity with vector databases, self-hosted inference, or GPU node pools.

Tech stack

• Orchestration: Managed Kubernetes (EKS/GKE) + On-Prem/Lightweight K8s (K3s/Rancher)

• IaC & GitOps: Terraform, ArgoCD/Flux

• Messaging & Data: Apache Kafka (KRaft mode)

• Identity & Secrets: Keycloak (OIDC/RBAC), HashiCorp Vault

• Observability: OpenTelemetry, Prometheus, Loki, Tempo

Great people rarely fit completely into job descriptions.

If you’re curious, driven, and excited by what we’re building, apply - even if your experience doesn’t match every bullet point.

Different perspectives make better ideas, stronger teams, and better outcomes for our customers.

Come build with us.