> Markdown version of [/jobs/ext/1273571-head-of-infrastructure-devops-sre](https://www.wearedevelopers.com/jobs/ext/1273571-head-of-infrastructure-devops-sre). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Head of Infrastructure, DevOps & SRE - **Company:** WATU INC. - **Location:** United States (Remote available) - **Experience:** Expert - **Contract:** Permanent contract - **Skills:** Artificial Intelligence, Amazon Web Services, Software System Penetration Testing, Cloud Computing, Cloud Computing Security, Continuous Integration, DevOps, Domain Name System (DNS), Github, Identity and Access Management, Virtual Private Networks (VPN), Key Management, Network Security, Network Segmentation, Open Web Application Security, Peering, Reliability Engineering, Prometheus, Software Vulnerability Management, Datadog, SSL Certificate Management, Cloud Platform System, Autoscaling, Istio, Large Language Models, Grafana, Mttr, HybridCloud, Kubernetes, Information Technology, Integration Frameworks, Hardware Infrastructure, Api Gateway, Terraform, Vulnerability Analysis - **Published:** July 15, 2026 - **Apply:** https://www.indeed.com/viewjob?jk=8bf98ef56f1847d7 ## About the Role * 8+ years of infrastructure and DevOps engineering experience, with at least 3 years in a senior technical leadership role owning a production cloud environment at scale. * Deep AWS expertise - not just familiarity. You can architect, cost-optimise, secure, and operate a complex AWS environment across multiple accounts and regions. * Kubernetes at production depth: cluster operations, workload scheduling, autoscaling, networking (CNI, service mesh), storage, and multi-cluster management. * CI/CD engineering leadership: you have designed and owned GitHub Actions (or equivalent) pipelines for multiple engineering teams, and you understand the developer experience implications of every infrastructure decision. * SRE practice: you have defined and maintained SLOs, built on-call rotations, owned incident response tooling, and driven MTTR improvement through systematic means. * Infrastructure-as-code is second nature: Terraform at production scale, GitOps patterns, environment promotion pipelines. * Experience managing distributed infrastructure teams across multiple timezones - you have done this and it has worked. * Security-first mindset: you treat IAM, secrets management, network segmentation, and vulnerability management as first-class engineering concerns, not compliance checkboxes. Strongly preferred * Experience with hybrid cloud/on-premises architectures - you have managed infrastructure that spans cloud and physical environments simultaneously. * Fintech or payments infrastructure background - you understand the reliability, security, and compliance requirements of systems that move money. * Experience exiting a managed infrastructure provider dependency and taking full ownership of operations in-house. * Familiarity with African market infrastructure constraints: connectivity variability, local cloud presence limitations, latency to global providers. * Experience with observability tooling at depth: Prometheus/Grafana, or equivalent - not just setup, but instrumentation strategy and alerting discipline. * Exposure to payment provider connectivity: private peering, dedicated connectivity, or VPN architecture for financial integrations. ## Description AWS + on-prem hybrid · Kubernetes (EKS + on-prem K8s) · GitHub Actions · Terraform, This is a senior leadership hire that owns the entire deployment substrate at Watu. You will lead a 7-person Infrastructure, DevOps & SRE team responsible for cloud infrastructure, on-premises systems, Kubernetes operations, CI/CD pipelines, site reliability, and security engineering. The team is already designed - you are inheriting a defined structure and will immediately take ownership of it. Your first priority is standing it up, hiring the open positions, and asserting technical authority over the infrastructure layer across all engineering functions. You will report directly to the CTO and be a peer to the two Heads of Engineering. The clean boundary you are responsible for is: Infrastructure, DevOps & SRE owns the deployment substrate; the engineering squads build on top of it. Defending and maintaining that boundary is part of the job. This role is remote-first in Europe, reflecting where the existing Riga-based infrastructure team sits. You will travel occasionnally to Nairobi for market presence and to Riga for team operations. You will be expected to be fully available across both Central European and East African time zones during critical periods. What You Will Own Cloud & on-premises infrastructure * Own the AWS cloud environment end-to-end: account structure, VPCs, IAM, cost optimisation, and architectural governance across all environments. * Manage on-premises infrastructure in local markets alongside the cloud layer - hybrid architecture is a reality, not a transition state. * Own the Kubernetes fleet: EKS in AWS and on-prem K8s clusters. Cluster lifecycle management, upgrades, autoscaling, workload isolation, and cost allocation. * Exit (or reduce to pure added capacity only) the existing partner dependency and take full ownership of infrastructure operations - this is an explicit objective for the first 6 months. CI/CD and developer platform * Own CI/CD infrastructure for all engineering squads (8 squads across CXE and Platform Engineering). GitHub Actions is the standard - you govern the pipelines, environments, and deployment patterns. * Define and enforce deployment standards: environment promotion, feature flags, blue-green or canary patterns, rollback procedures. * Act as the internal platform team for infrastructure concerns - squads should be able to deploy confidently without becoming infrastructure experts. * Drive automation-first thinking: if a process is manual and repeatable, it should be automated. Infrastructure-as-code (Terraform or equivalent) is non-negotiable. Site reliability & on-call * Own SLOs, SLAs, and error budgets across all production services. Define them in collaboration with engineering squads; hold the line on them operationally. * Build and operate the on-call rotation for L3 escalations from the L2 Operations Center. L3 engineers come from the squads - you govern the process, tooling, and runbooks that make the rotation viable. * Own incident response infrastructure: alerting, observability tooling (Prometheus/Grafana, or equivalent), and the post-incident review process. * Drive MTTR down over time - not through heroics, but through better observability, automated remediation, and runbook discipline. Networking & connectivity * Own networking across all environments: VPCs, VPNs, peering, private connectivity to payment providers and third-party integrations. * Manage connectivity to local market infrastructure - call systems, local monitoring agents, and market-specific network requirements are your problem to solve alongside the Head of IT. * Own DNS, certificate management, and API gateway infrastructure. Security engineering * Own infrastructure security: secrets management (AWS Secrets Manager or Vault), IAM least-privilege enforcement, network security groups, and vulnerability scanning at the infrastructure layer. * Ensure OWASP compliance at the infrastructure level; own dependency scanning, container image scanning, and penetration testing cadence. * Work with the Head of IT to ensure local market infrastructure and IT systems meet the same security baseline as the cloud platform. Team and people * Lead and develop the 7-person team: Lead DevOps Engineer, Senior Cloud Infrastructure Engineer, SRE/Cloud Security Engineer, Infrastructure & Network Engineer, two DevOps/Platform Engineers (Riga and Brazil). * The Brazil hire provides LATAM timezone coverage and Africa off-hours backup - building and managing a distributed team across 3 continents is part of the job. * Be the technical authority your team needs: available for escalation, capable of diving into the hardest infrastructure problems personally, and consistently raising the bar., * You hold the line on infrastructure quality. Squads want to move fast - your job is to make fast safe, not to be the person who says no. * You are comfortable being the person who carries a pager. You would not ask your team to be on-call for something you would not be on-call for yourself. * You communicate clearly across technical and non-technical audiences. When something is down, the CTO and the business need to understand what is happening and why. * You think about the cost of every architecture decision - cloud spend is real and you treat it like it is your own money. * You are not precious about tooling. The best tool for the job is the one that solves the problem reliably and your team can operate confidently. * You are genuinely excited about AI/LLM tooling for infrastructure automation - runbook generation, incident triage, IaC authoring - and you model that for your team. Infrastructure Context Some important context about where we are today and what you are walking into: * We want to operate a hybrid AWS + on-premises environment. The on-prem layer is not going away - local market infrastructure for call systems and monitoring is a permanent part of the architecture. * We are in the process of exiting or reducing our dependency with our existing partner, our current managed infrastructure provider. Taking full operational ownership of the infrastructure layer is an explicit objective for this hire. * The Kubernetes environment will span EKS in AWS and on-prem K8s. Both will need active management. * CI/CD pipelines exist but are not standardised across all squads. Imposing a consistent standard across 8 engineering squads is one of your first-year deliverables. * The L2 Operations Center (platform monitoring, incident management, change management) sits under the Head of IT. You will be the primary L3 escalation target from the L2 team and you own the runbooks and tooling that make L3 escalation viable. * Security engineering at the infrastructure layer is currently distributed and inconsistent. You will establish the baseline and own it. ## Related Videos - [Inside Bitpanda's Tech Stack: Scaling a European Fintech Leader - Markus Dorner](https://www.wearedevelopers.com/videos/1979-inside-bitpanda-s-tech-stack-scaling-a-european-fintech-leader-markus-dorner) - [Rate-limiting using eBPF and Istio: How to protect your SaaS customers from themselves](https://www.wearedevelopers.com/videos/100220-rate-limiting-using-ebpf-and-istio-how-to-protect-your-saas-customers-from-themselves) - [What Developers Get Wrong About Application Quality](https://www.wearedevelopers.com/videos/233-what-developers-get-wrong-about-application-quality) - [From DevOps to Scaled DevOps: How We’re Rebuilding Continuous Delivery as a Platform](https://www.wearedevelopers.com/videos/100018-from-devops-to-scaled-devops-how-we-re-rebuilding-continuous-delivery-as-a-platform) - [Get started with securing your cloud-native Java microservices applications](https://www.wearedevelopers.com/videos/123-get-started-with-securing-your-cloud-native-java-microservices-applications) - [DevOps Maturity Check – a way to balance autonomy and alignment](https://www.wearedevelopers.com/videos/58-devops-maturity-check-a-way-to-balance-autonomy-and-alignment) ## Related Articles - [How We Built a Worry-Free System That Runs for 10+ Years – And What We’d Do Again](https://www.wearedevelopers.com/magazine/751-how-we-built-a-worry-free-system-that-runs-for-10-years-and-what-we-d-do-again) - [Best US AI Conferences for CTOs in 2026: Build vs. Buy, Vendor Evaluation, and Peer Intelligence](https://www.wearedevelopers.com/magazine/736-best-us-ai-conferences-for-ctos-in-2026-build-vs-buy-vendor-evaluation-and-peer-intelligence) - [Highest Paying Tech Companies for Developers](https://www.wearedevelopers.com/magazine/220-highest-paying-tech-companies-for-developers) - [Fully Remote Software Engineer Jobs](https://www.wearedevelopers.com/magazine/447-fully-remote-software-engineer-jobs) - [What Makes WeAreDevelopers World Congress Different From Every Other Tech Event?](https://www.wearedevelopers.com/magazine/701-what-makes-wearedevelopers-world-congress-different-from-every-other-tech-event) - [Why Attend a Developer Event in 2026?](https://www.wearedevelopers.com/magazine/688-why-attend-a-developer-event-in-2026)