Tech Lead - Cloud Platform Engineering

Responsibilities:

• Productize the Platform: Set the technical strategy and roadmap for the internal cloud platform. Treat internal application and domain teams as customers with real SLAs, feedback loops, and self-serve developer portals (e. g., Backstage).
• Architect Production Networking: Own the end-to-end connectivity architecture across five markets, managing VPC/multi-account topologies, Transit Gateway, Direct Connect, VPN, BGP route propagation, DNS failover, and carrier-diverse pathing to eradicate single points of failure.
• Manage a Mixed Estate: Oversee both Kubernetes and non-Kubernetes workloads (EC2 and bare-metal environments) used for latency-sensitive components like card authorisation paths, ISO 8583 processing, and HSM key management.
• Drive Resilience and Automated Remediation: Establish cross-region and cross-AZ resilience architecture to hit strict RTO/RPO targets. Run regular chaos drills, backup/restore validations, and build event-driven, agentic remediation systems to automatically triage and heal common incidents before humans are paged.
• Enforce Security and Compliance by Default: Bake policy-as-code and zero-trust security into the infrastructure fabric. Ensure immutable audit logging to generate hands-free evidence for MAS-TRM, PCI DSS, ISO 27001 and SOC 2 compliance.
• Set the Engineering Bar: Hold the platform team's own code to the highest standard. Enforce rigorous testing for IaC (Terraform/Pulumi), CI linting, secret scanning, trunk-based development, and GitOps workflows (ArgoCD/Flux).
• Govern Unit Economics: Shift the paradigm from reactive monthly spend cleanup to proactive cost awareness. Build granular visibility tools to define what a specific tenant, environment, or transaction costs, and implement showback systems to drive engineering behaviour.
• Lead and Mentor: Lead a small, agile platform team through hands-on architecture, code reviews, and mentorship. Balance the daily tension between shipping features and hardening infrastructure while communicating complex trade-offs to non-technical stakeholders.

Requirements:

• Experience: 10+ years in cloud infrastructure or platform engineering, with a proven track record of designing multi-tenant systems and leading teams or major platform initiatives.
• Platform Mindset: Direct experience building internal developer platforms, APIs, and portals- not just basic CI/CD pipelines.
• Core Networking and Cloud Depth: Advanced AWS expertise (Organisations, Control Tower, IAM) along with deep networking mastery (BGP, Transit Gateway, Direct Connect, path diversity, and route table debugging).
• Containerization and OS Fundamentals: Deep Kubernetes knowledge (operators, Helm, RBAC, OPA/Gatekeeper, Kyverno, CNIs) paired with strong Linux fundamentals and comfort tuning/hardening bare-metal and EC2 environments.
• Automation and Tooling: Fluency in Python and/or Go for tooling, alongside advanced IaC (Terraform or Pulumi) and GitOps (ArgoCD or Flux).
• Incident Automation: Practical experience building event-driven or agentic automation frameworks for audited, bounded incident triage and self-healing.
• Security and Compliance: Strong background operating under strict compliance frameworks (MAS-TRM, PCI DSS, ISO 27001 SOC 2) using identity federation (OIDC/JWT), secrets management, and network segmentation.
• Observability and FinOps: Experience defining metrics, traces, and logs (Prometheus, OpenTelemetry, Grafana) to back SLOs, alongside a mindset focused on the unit economics of cloud spend.

Nice-to-Haves:

• Background in Fintech, payments, or Banking-as-a-Service (BaaS), and familiarity with privacy regulations like PDPA and GDPR.
• Hands-on experience with payments infrastructure (ISO 8583 processing, card auth latency paths, and PCI-scoped network isolation).
• Production experience managing API gateways or service meshes (Kong, Apigee, Istio, Envoy) utilising traffic routing and zero-downtime releases.
• Familiarity with progressive delivery (canary, blue-green), automated rollbacks, and chaos engineering practices.
• Relevant industry certifications (e. g., CKA/CKS, AWS Solutions Architect Professional, AWS Security, or advanced networking certs).