Job Summary

This is a senior leadership hire that owns the entire deployment substrate at Watu. You will lead a 7-person Infrastructure, DevOps & SRE team responsible for cloud infrastructure, on-premises systems, Kubernetes operations, CI/CD pipelines, site reliability, and security engineering.

The team is already designed – you are inheriting a defined structure and will immediately take ownership of it. Your first priority is standing it up, hiring the open positions, and asserting technical authority over the infrastructure layer across all engineering functions.

You will report directly to the CTO and be a peer to the two Heads of Engineering. The clean boundary you are responsible for is: Infrastructure, DevOps & SRE owns the deployment substrate; the engineering squads build on top of it. Defending and maintaining that boundary is part of the job.

This role is remote-first in Europe, reflecting where the existing Riga-based infrastructure team sits. You will travel occasionnally to Nairobi for market presence and to Riga for team operations. You will be expected to be fully available across both Central European and East African time zones during critical periods.

Responsibilities

Cloud & on-premises infrastructure

• Own the AWS cloud environment end-to-end: account structure, VPCs, IAM, cost optimisation, and architectural governance across all environments.
• Manage on-premises infrastructure in local markets alongside the cloud layer – hybrid architecture is a reality, not a transition state.
• Own the Kubernetes fleet: EKS in AWS and on-prem K8s clusters. Cluster lifecycle management, upgrades, autoscaling, workload isolation, and cost allocation.
• Exit (or reduce to pure added capacity only) the existing partner dependency and take full ownership of infrastructure operations – this is an explicit objective for the first 6 months.

CI/CD and developer platform

• Own CI/CD infrastructure for all engineering squads (8 squads across CXE and Platform Engineering). GitHub Actions is the standard – you govern the pipelines, environments, and deployment patterns.
• Define and enforce deployment standards: environment promotion, feature flags, blue-green or canary patterns, rollback procedures.
• Act as the internal platform team for infrastructure concerns – squads should be able to deploy confidently without becoming infrastructure experts.
• Drive automation-first thinking: if a process is manual and repeatable, it should be automated. Infrastructure-as-code (Terraform or equivalent) is non-negotiable.

Site reliability & on-call

• Own SLOs, SLAs, and error budgets across all production services. Define them in collaboration with engineering squads; hold the line on them operationally.
• Build and operate the on-call rotation for L3 escalations from the L2 Operations Center. L3 engineers come from the squads – you govern the process, tooling, and runbooks that make the rotation viable.
• Own incident response infrastructure: alerting, observability tooling (Prometheus/Grafana, or equivalent), and the post-incident review process.
• Drive MTTR down over time – not through heroics, but through better observability, automated remediation, and runbook discipline.

Networking & connectivity

• Own networking across all environments: VPCs, VPNs, peering, private connectivity to payment providers and third-party integrations.
• Manage connectivity to local market infrastructure – call systems, local monitoring agents, and market-specific network requirements are your problem to solve alongside the Head of IT.
• Own DNS, certificate management, and API gateway infrastructure.

Security engineering

• Own infrastructure security: secrets management (AWS Secrets Manager or Vault), IAM least-privilege enforcement, network security groups, and vulnerability scanning at the infrastructure layer.
• Ensure OWASP compliance at the infrastructure level; own dependency scanning, container image scanning, and penetration testing cadence.
• Work with the Head of IT to ensure local market infrastructure and IT systems meet the same security baseline as the cloud platform.

Team and people

• Lead and develop the 7-person team: Lead DevOps Engineer, Senior Cloud Infrastructure Engineer, SRE/Cloud Security Engineer, Infrastructure & Network Engineer, two DevOps/Platform Engineers (Riga and Brazil).
• The Brazil hire provides LATAM timezone coverage and Africa off-hours backup – building and managing a distributed team across 3 continents is part of the job.
• Be the technical authority your team needs: available for escalation, capable of diving into the hardest infrastructure problems personally, and consistently raising the bar.

Requirements

Essential

• 8+ years of infrastructure and DevOps engineering experience, with at least 3 years in a senior technical leadership role owning a production cloud environment at scale.
• Deep AWS expertise – not just familiarity. You can architect, cost-optimise, secure, and operate a complex AWS environment across multiple accounts and regions.
• Kubernetes at production depth: cluster operations, workload scheduling, autoscaling, networking (CNI, service mesh), storage, and multi-cluster management.
• CI/CD engineering leadership: you have designed and owned GitHub Actions (or equivalent) pipelines for multiple engineering teams, and you understand the developer experience implications of every infrastructure decision.
• SRE practice: you have defined and maintained SLOs, built on-call rotations, owned incident response tooling, and driven MTTR improvement through systematic means.
• Infrastructure-as-code is second nature: Terraform at production scale, GitOps patterns, environment promotion pipelines.
• Experience managing distributed infrastructure teams across multiple timezones – you have done this and it has worked.
• Security-first mindset: you treat IAM, secrets management, network segmentation, and vulnerability management as first-class engineering concerns, not compliance checkboxes.

Strongly preferred

• Experience with hybrid cloud/on-premises architectures – you have managed infrastructure that spans cloud and physical environments simultaneously.
• Fintech or payments infrastructure background – you understand the reliability, security, and compliance requirements of systems that move money.
• Experience exiting a managed infrastructure provider dependency and taking full ownership of operations in-house.
• Familiarity with African market infrastructure constraints: connectivity variability, local cloud presence limitations, latency to global providers.
• Experience with observability tooling at depth: Prometheus/Grafana, or equivalent – not just setup, but instrumentation strategy and alerting discipline.
• Exposure to payment provider connectivity: private peering, dedicated connectivity, or VPN architecture for financial integrations.

The kind of person we are looking for

• You hold the line on infrastructure quality. Squads want to move fast – your job is to make fast safe, not to be the person who says no.
• You are comfortable being the person who carries a pager. You would not ask your team to be on-call for something you would not be on-call for yourself.
• You communicate clearly across technical and non-technical audiences. When something is down, the CTO and the business need to understand what is happening and why.
• You think about the cost of every architecture decision – cloud spend is real and you treat it like it is your own money.
• You are not precious about tooling. The best tool for the job is the one that solves the problem reliably and your team can operate confidently.
• You are genuinely excited about AI/LLM tooling for infrastructure automation – runbook generation, incident triage, IaC authoring – and you model that for your team.

• Own the AWS cloud environment end-to-end: account structure, VPCs, IAM, cost optimisation, and architectural governance across all environments.
• Manage on-premises infrastructure in local markets alongside the cloud layer – hybrid architecture is a reality, not a transition state.
• Own the Kubernetes fleet: EKS in AWS and on-prem K8s clusters. Cluster lifecycle management, upgrades, autoscaling, workload isolation, and cost allocation.
• Exit (or reduce to pure added capacity only) the existing partner dependency and take full ownership of infrastructure operations – this is an explicit objective for the first 6 months.
• Own CI/CD infrastructure for all engineering squads (8 squads across CXE and Platform Engineering). GitHub Actions is the standard – you govern the pipelines, environments, and deployment patterns.
• Define and enforce deployment standards: environment promotion, feature flags, blue-green or canary patterns, rollback procedures.
• Act as the internal platform team for infrastructure concerns – squads should be able to deploy confidently without becoming infrastructure experts.
• Drive automation-first thinking: if a process is manual and repeatable, it should be automated. Infrastructure-as-code (Terraform or equivalent) is non-negotiable.
• Own SLOs, SLAs, and error budgets across all production services. Define them in collaboration with engineering squads; hold the line on them operationally.
• Build and operate the on-call rotation for L3 escalations from the L2 Operations Center. L3 engineers come from the squads – you govern the process, tooling, and runbooks that make the rotation viable.
• Own incident response infrastructure: alerting, observability tooling (Prometheus/Grafana, or equivalent), and the post-incident review process.
• Drive MTTR down over time – not through heroics, but through better observability, automated remediation, and runbook discipline.
• Own networking across all environments: VPCs, VPNs, peering, private connectivity to payment providers and third-party integrations.
• Manage connectivity to local market infrastructure – call systems, local monitoring agents, and market-specific network requirements are your problem to solve alongside the Head of IT.
• Own DNS, certificate management, and API gateway infrastructure.
• Own infrastructure security: secrets management (AWS Secrets Manager or Vault), IAM least-privilege enforcement, network security groups, and vulnerability scanning at the infrastructure layer.
• Ensure OWASP compliance at the infrastructure level; own dependency scanning, container image scanning, and penetration testing cadence.
• Work with the Head of IT to ensure local market infrastructure and IT systems meet the same security baseline as the cloud platform.
• Lead and develop the 7-person team: Lead DevOps Engineer, Senior Cloud Infrastructure Engineer, SRE/Cloud Security Engineer, Infrastructure & Network Engineer, two DevOps/Platform Engineers (Riga and Brazil).
• The Brazil hire provides LATAM timezone coverage and Africa off-hours backup – building and managing a distributed team across 3 continents is part of the job.
• Be the technical authority your team needs: available for escalation, capable of diving into the hardest infrastructure problems personally, and consistently raising the bar.

• Cloud management
• CI/CD automation
• Site reliability
• AWS expertise
• Kubernetes operations
• Terraform
• GitHub Actions
• SLOs
• SLAs
• Incident response
• Observability tooling
• Networking
• Security engineering
• Secrets management
• IAM
• Vulnerability scanning
• OWASP compliance
• Team leadership
• Distributed team management

• 8+ years of infrastructure and DevOps engineering experience
• At least 3 years in a senior technical leadership role owning a production cloud environment at scale
• Deep AWS expertise
• Kubernetes at production depth
• CI/CD engineering leadership
• SRE practice experience
• Infrastructure-as-code experience (Terraform at production scale, GitOps patterns)
• Experience managing distributed infrastructure teams across multiple timezones
• Security-first mindset
• Experience with hybrid cloud/on-premises architectures (preferred)
• Fintech or payments infrastructure background (preferred)
• Experience exiting a managed infrastructure provider dependency (preferred)
• Familiarity with African market infrastructure constraints (preferred)
• Experience with observability tooling at depth (preferred)
• Exposure to payment provider connectivity (preferred)