Lead Infrastructure Engineer - Netherlands

ph3Role in one sentence /h3 pA hands-on infrastructure lead who owns the Kubernetes-native foundation for Rojo's New Integration Products. This covers the cluster, IaC, secrets, identity, messaging, and observability. /p pThis is a greenfield build. There's no legacy infra and no existing conventions to inherit. Every foundational decision gets made once, by this person, and lived with for years. That takes someone senior enough to set direction and own it. As we scale, this person will build and lead a team. Right now, the focus is architecture. The person writes the Terraform, configures the cluster, debugs the Kafka broker. /p pThe infra has to cover several key pillars from day one: /p ul liTenant Isolation: Namespace-per-tenant, default-deny network policy, per-tenant secrets, and identity realms. /li liHybrid On-Prem Deployment: Hosting central control planes in the cloud while supporting deployment across on-premises or private cloud customer environments. /li liDurability Messaging: Kafka as the backbone for event-driven components. /li liEU Data Sovereignty: Region, encryption, audit trails, and self-hosted vs. managed choices that hold up under GDPR and EU AI Act rules. /li liObservability: Every span, log, and metric traceable per tenant across all deployed environments. /li /ul h3Must-haves /h3 ul li5+ years of experience owning production infrastructure end-to-end at a startup or scale-up. Ideally as an early or first infra hire with full accountability. /li liKubernetes Expertise (Managed On-Prem): Strong experience with cloud-managed K8s (EKS/GKE) as well as self-hosted, bare-metal, or lightweight distributions (e.g., K3s, Rancher, OpenShift) for on-premise setups. Deep grasp of namespace-per-tenant patterns, ResourceQuota/LimitRange, NetworkPolicy (default-deny), Pod Security Admission, and autoscaling. /li liHybrid Networking Connectivity: Experience with secure cross-environment networking (VPNs, mTLS, reverse proxies, WireGuard) to establish reliable communication between cloud control planes and on-premise execution nodes. /li liTerraform / IaC: Modular design (network / cluster / IAM / tenant-namespace / addons), remote state with locking, and state-splitting for blast-radius control. Treats IaC as a long-lived codebase. /li liApache Kafka: Production experience (ideally KRaft mode). Broker sizing, replication/AZ placement, Schema Registry, DLQ/DLT, and retry topology. /li liIdentity Secrets Infrastructure: An OIDC/RBAC identity provider (e.g., Keycloak) with per-tenant realm patterns. A secrets manager (e.g., Vault) with Kubernetes-native auth and zero-hardcoded-secrets enforcement. /li liCI/CD: Practical experience with pipelines (e.g., GitHub Actions), lint/test/build/push/deploy flows, OIDC-based cloud auth, and secret-scanning pre-commit hooks. /li liObservability Infrastructure: OpenTelemetry Collector deployment patterns and a metrics/logs/traces stack (e.g., Prometheus, Loki, Tempo) built to be tenant-aware across hybrid environments. /li liLeadership Independence: Sets technical direction, defends architecture choices (e.g., node pool strategy, partitioning, IAM boundaries), and prioritizes ruthlessly without needing a pre-built roadmap. /li liLanguage: Fluent English. Works well directly within a small, fast-moving technical team. /li /ul h3Nice-to-haves /h3 ul liGitOps Patterns: Experience with multi-cluster management and GitOps workflows (e.g., ArgoCD, Flux) for deploying and maintaining workloads across multi-region or on-prem environments. /li liMulti-tenant Regulated SaaS: Experience with compliance (finserv, healthcare, public sector), data residency, audit logging, and encryption-at-rest requirements. /li liIntegration/ESB Runtimes: Familiarity with engines like Apache Camel or durable-execution/workflow orchestration engines (e.g., Temporal.io). /li liAPI Gateways: Rate limiting, mTLS termination, per-tenant quotas. /li liAI/LLM Infrastructure: Basic familiarity with vector databases, self-hosted inference, or GPU node pools. /li /ul h3Tech stack /h3 ul liOrchestration: Managed Kubernetes (EKS/GKE) + On-Prem/Lightweight K8s (K3s/Rancher) /li liIaC GitOps: Terraform, ArgoCD/Flux /li liMessaging Data: Apache Kafka (KRaft mode) /li liIdentity Secrets: Keycloak (OIDC/RBAC), HashiCorp Vault /li liObservability: OpenTelemetry, Prometheus, Loki, Tempo /li /ul pbWe are looking forward to receiving your application, but please note, that only applicants with an EU citizenship or a valid residency/work permit will be considered for this role. /b /p pGreat people rarely fit completely into job descriptions. /p pIf you’re curious, driven, and excited by what we’re building, apply - even if your experience doesn’t match every bullet point. /p pDifferent perspectives make better ideas, stronger teams, and better outcomes for our customers. /p pCome build with us. /p /p #J-18808-Ljbffr