Cloud Application Architect

tonder; Ciudad de México; On-site; MXN 1,500,000 - 2,100,000; Full time

Job summary

tonder is seeking a Cloud Application Architect to design and own how the platform runs on AWS, from Docker Compose to ECS across AZs, Aurora PostgreSQL, and zero-downtime deploys. You decide task sizes and memory, and how the database moves without a maintenance window, while hands-on in Terraform and pipelines with the SRE team.

You will work in Spanish and English with a distributed team across the Americas, joining during design and handing over with a runbook.

Qualifications

• 7+ years in engineering with production AWS workloads that cannot go down.
• Experience with ECS (EC2/Fargate) or Kubernetes in production.
• Terraform modules, remote state, CI plans.
• Aurora or RDS PostgreSQL operations and migrations without downtime.
• ElastiCache/Valkey, SQS, Kinesis, Lambda, API Gateway.
• ALB/NLB, WAF, Route 53, VPC, IAM; multi-account governance.
• Linux/container debugging and Datadog or equivalent observability.
• Professional Spanish and English.

Responsibilities

• Own runtime architecture for Python services on AWS (ECS/K8s).
• Migrate data tiers with near-zero downtime and managed read replicas.
• Manage caching, messaging, and event streams with AWS services.
• Design edge networking and private connectivity across accounts.
• Lead infrastructure as code with Terraform and CI pipelines.
• Ensure security, PCI DSS/SOC 2 controls, and audits.
• Collaborate with SRE and operate in bilingual teams.

Skills

Engineering experience

AWS production workloads

Container orchestration

Terraform

Aurora PostgreSQL

ElastiCache/Valkey

SQS/Kinesis

Lambda

DynamoDB/API Gateway

Networking & Security (VPC/IAM)

Linux/Container debugging

Datadog / Observability

CI/CD (GitHub Actions)

Zero-downtime migrations

PCI DSS / SOC 2 awareness

Professional Spanish and English

Tools

Terraform

GitHub Actions

Job description

Mission. Design and own how the platform runs on AWS: from a single host with Docker Compose to ECS across three availability zones, Aurora PostgreSQL, Valkey, zero-downtime deploys and autoscaling, and later a second region. You decide task sizes and memory limits, how gunicorn and Celery are laid out, how the database moves without a maintenance window, and how the whole thing fails over. You are hands-on in Terraform and pipelines, and you partner with the SRE team that operates what you design.

Reports to the Head of Platform and Reliability

What you will own

• Runtime architecture for the Django API and the Celery workers on ECS: task sizing, CPU and memory limits, worker and thread topology, health checks, graceful shutdown, rolling or blue-green deploys.
• The data tier: RDS to Aurora migration with near-zero downtime, RDS Proxy and IAM authentication, read replicas, backups, point-in-time recovery, cross-region replication.
• Cache and messaging: Redis to Valkey on ElastiCache with replication; SQS and dead-letter queue hygiene; Kinesis capacity and consumer concurrency.
• Edge and network: ALB and NLB, WAF in block mode, per-merchant rate limiting, TLS, VPC design, private connectivity to providers, a multi-account landing zone with Organizations and SSO.
• Operations of the serverless estate: Lambda reserved and provisioned concurrency, canary deployments with alarms, dead-letter queues on every asynchronous path.
• Infrastructure as code and delivery: Terraform modules, GitHub Actions pipelines, environment parity, drift detection, rollback.
• Observability and cost: the Datadog APM rollout with the SRE team, SLO dashboards, capacity and cost visibility, Savings Plans and right-sizing.
• Resilience: load tests at 10x and 30x, game days, the disaster recovery plan with a tested runbook, the second-region design.
• PCI DSS infrastructure controls with the CISO: segmentation, hardening, logging, key management.

How you will work

• Design it, build the first version yourself with the SRE team, then hand it over with a runbook.
• Every production change goes through code review and a Terraform plan; no console changes.
• Join the platform on-call rotation after your first quarter.
• Work in Spanish and English with a distributed team across the Americas.

Cloud Application Architect: what we need from you

Must have

• 7+ years in engineering, at least 3 of them architecting production workloads on AWS that could not go down.
• ECS on EC2 and Fargate, or Kubernetes, in production with containerized Python applications; you know what gunicorn and Celery do under memory pressure.
• Terraform at module level, with remote state, workspaces and plans in CI.
• Aurora or RDS PostgreSQL operations and migrations: replication, parameter tuning, connection pooling, upgrades without downtime.
• ElastiCache or Valkey, SQS, Kinesis, Lambda, DynamoDB, API Gateway.
• ALB, NLB, WAF, Route 53, CloudFront, VPC design, IAM and multi-account governance with service control policies.
• Linux and container debugging: out-of-memory behavior, cgroups, page cache and swap, I/O saturation, network timeouts.
• Datadog or equivalent: APM, logs, metrics, synthetics, SLOs.
• GitHub Actions or similar; Python and Bash for automation.
• Has run at least one zero-downtime migration of a database or a runtime in production.
• Has worked inside PCI DSS or SOC 2 scope and knows what the auditor asks for.
• Professional Spanish and English.

Nice to have

• AWS Solutions Architect Professional or DevOps Engineer Professional.
• Multi-region disaster recovery on AWS that was actually tested.
• Kubernetes, FinOps practice, incident command experience.