Lead Infrastructure Engineer (Platform & Kubernetes)

About the role

We are looking for a hands-on Lead Infrastructure Engineer to build and own the infrastructure for Rojos new integration products. You will be our first infrastructure hire and will be responsible for the Kubernetes platform infrastructure as code messaging identity secrets security and observability.

This is a greenfield build with no legacy systems to work around so the decisions you make early on will shape the platform for years to the first phase you will be closely involved in the day-to-day work from writing Terraform and setting up clusters to troubleshooting Kafka. As the product grows you will build and lead the infrastructure team.

The platform needs to support the following from day one:

• Security: Least-privilege access encryption in transit and at rest secrets management and audit logging built in from the start rather than added later.

• Tenant Isolation: Namespace-per-tenant default-deny network policy per-tenant secrets and identity realms.

• Hybrid & On-Prem Deployment: Hosting central control planes in the cloud while supporting deployment across on-premises or private cloud customer environments.

• Durability & Messaging: Kafka as the backbone for event-driven components.

• EU Data Sovereignty: Region encryption audit trails and self-hosted vs. managed choices that hold up under GDPR and EU AI Act rules.

• Observability: Every span log and metric traceable per tenant across all deployed environments.

Who we are looking for

Someone who has built infrastructure from the ground up and owned it in production whether at a startup a new product team within a larger organisation or a venture of their own. You are comfortable making architecture decisions without a detailed roadmap can explain the trade-offs behind them and enjoy doing the hands-on work yourself.

This role suits someone who wants broad ownership more than someone looking for a narrowly defined scope within a large platform team.

Must-haves

• Experience: 6 years in infrastructure platform or SRE roles including at least one role where you built or rebuilt production infrastructure from the ground up and were responsible for running it.

• Kubernetes (Managed & On-Prem): Strong production experience including multi-tenant isolation (namespaces NetworkPolicy ResourceQuota/LimitRange Pod Security Admission) and autoscaling. Experience with a managed service (EKS GKE or AKS) as well as a self-hosted or on-prem distribution (e.g. K3s Rancher OpenShift).

• Hybrid Networking & Connectivity: Experience setting up secure connectivity between cloud control planes and customer-hosted environments (e.g. mTLS WireGuard/VPN reverse proxies).

• Infrastructure as Code: Modular design remote state with locking and state-splitting to limit blast radius. Terraform preferred; experience with OpenTofu Pulumi or Crossplane is also relevant.

• Distributed Messaging: Production experience running a messaging system including sizing replication DLQ and retry handling. Kafka preferred (KRaft is a plus); strong experience with Pulsar RabbitMQ or NATS is also relevant.

• Security: A solid understanding of infrastructure and cloud security including least-privilege IAM and RBAC network segmentation encryption in transit and at rest container and image hardening and secrets management (e.g. Vault) with OIDC-based identity (e.g. Keycloak). Familiarity with frameworks such as ISO 27001 SOC 2 or GDPR is a plus.

• Leadership & Independence: Experience setting technical direction documenting and defending architecture decisions and prioritising work without a predefined roadmap.

What you will own

• Identity and secrets: per-tenant identity patterns and Kubernetes-native secrets management with no hardcoded secrets.

• CI/CD: pipelines (e.g. GitHub Actions) with OIDC-based cloud authentication and secret scanning.

• Observability: tenant-aware metrics logs and traces across hybrid environments (OpenTelemetry Prometheus Loki Tempo).

• Compliance: the EU data-sovereignty setup covering regions encryption audit trails GDPR and the EU AI Act.

Hands-on experience with all of these is not required from day one but you should be able to take ownership of them.

Nice-to-haves

• GitOps Patterns: Experience with multi-cluster management and GitOps workflows (e.g. ArgoCD Flux) for deploying and maintaining workloads across multi-region or on-prem environments.

• Multi-tenant Regulated SaaS: Experience with compliance (finserv healthcare public sector) data residency audit logging and encryption-at-rest requirements.

• Integration/ESB Runtimes: Familiarity with engines like Apache Camel or durable-execution/workflow orchestration engines (e.g. ).

• API Gateways: Rate limiting mTLS termination per-tenant quotas.

• AI/LLM Infrastructure: Basic familiarity with vector databases self-hosted inference or GPU node pools.

Tech stack

• Orchestration: Managed Kubernetes (EKS/GKE) On-Prem/Lightweight K8s (K3s/Rancher)

• IaC & GitOps: Terraform ArgoCD/Flux

• Messaging & Data: Apache Kafka (KRaft mode)

• Identity & Secrets: Keycloak (OIDC/RBAC) HashiCorp Vault

• Observability: OpenTelemetry Prometheus Loki Tempo

Great people rarely fit completely into job descriptions.

If youre curious driven and excited by what were building apply - even if your experience doesnt match every bullet point.

Different perspectives make better ideas stronger teams and better outcomes for our customers.

Come build with us.

Required Experience:

IC