Lead Infrastructure Engineer - Netherlands

Rojo Integrations; Breukelen; Hybride; EUR 110 000 - 190 000; Plein temps

Résumé du poste

Rojo Integrations is seeking a hands-on infrastructure lead to own the Kubernetes-native foundation for new integration products. You will architect and implement the cluster, IaC, secrets, identity, messaging, and observability from day one.

In a greenfield environment, you’ll define conventions, drive security patterns, and ensure GDPR/EU data sovereignty. Eventually you’ll build and lead a team while focusing on architecture and scale.

Qualifications

• 5+ years owning production infrastructure end-to-end at a startup or scale-up.
• Experience with cloud-managed Kubernetes (EKS/GKE) and on-prem or lightweight distros.
• Strong knowledge of namespace-per-tenant patterns, NetworkPolicy, and security hardening.
• Experience with cross-environment secure networking (VPNs, mTLS, proxies).
• Proven IaC design with modular networks/clusters/IAM/tenants.

Responsabilités

• Own the Kubernetes-native foundation for Rojo's new integration products.
• Write Terraform configs, configure the cluster, and debug the Kafka broker.
• Define architecture and scale by building a team when needed.
• Defend architectural decisions and set direction for multi-tenant infra.

Connaissances

Kubernetes expertise

Terraform / IaC

Kafka / event streaming

Identity & secrets

CI/CD pipelines

Observability stack

Leadership & independence

English communication

Outils

Terraform

ArgoCD/Flux

Kafka (KRaft)

Keycloak

HashiCorp Vault

OpenTelemetry

Prometheus

Loki

Tempo

Kubernetes (EKS/GKE)

Description du poste

Role in one sentence

A hands-on infrastructure lead who owns the Kubernetes-native foundation for Rojo's New Integration Products. This covers the cluster, IaC, secrets, identity, messaging, and observability.

This is a greenfield build. There's no legacy infra and no existing conventions to inherit. Every foundational decision gets made once, by this person, and lived with for years. That takes someone senior enough to set direction and own it. As we scale, this person will build and lead a team. Right now, the focus is architecture. The person writes the Terraform, configures the cluster, debugs the Kafka broker.

The infra has to cover several key pillars from day one:

• Tenant Isolation: Namespace-per-tenant, default-deny network policy, per-tenant secrets, and identity realms.
• Hybrid & On-Prem Deployment: Hosting central control planes in the cloud while supporting deployment across on-premises or private cloud customer environments.
• Durability & Messaging: Kafka as the backbone for event-driven components.
• EU Data Sovereignty: Region, encryption, audit trails, and self-hosted vs. managed choices that hold up under GDPR and EU AI Act rules.
• Observability: Every span, log, and metric traceable per tenant across all deployed environments.

Must-haves

• 5+ years of experience owning production infrastructure end-to-end at a startup or scale-up. Ideally as an early or first infra hire with full accountability.
• Kubernetes Expertise (Managed & On-Prem): Strong experience with cloud-managed K8s (EKS/GKE) as well as self-hosted, bare-metal, or lightweight distributions (e.g., K3s, Rancher, OpenShift) for on-premise setups. Deep grasp of namespace-per-tenant patterns, ResourceQuota/LimitRange, NetworkPolicy (default-deny), Pod Security Admission, and autoscaling.
• Hybrid Networking & Connectivity: Experience with secure cross-environment networking (VPNs, mTLS, reverse proxies, WireGuard) to establish reliable communication between cloud control planes and on-premise execution nodes.
• Terraform / IaC: Modular design (network / cluster / IAM / tenant-namespace / addons), remote state with locking, and state-splitting for blast-radius control. Treats IaC as a long-lived codebase.
• Apache Kafka: Production experience (ideally KRaft mode). Broker sizing, replication/AZ placement, Schema Registry, DLQ/DLT, and retry topology.
• Identity & Secrets Infrastructure: An OIDC/RBAC identity provider (e.g., Keycloak) with per-tenant realm patterns. A secrets manager (e.g., Vault) with Kubernetes-native auth and zero-hardcoded-secrets enforcement.
• CI/CD: Practical experience with pipelines (e.g., GitHub Actions), lint/test/build/push/deploy flows, OIDC-based cloud auth, and secret-scanning pre-commit hooks.
• Observability Infrastructure: OpenTelemetry Collector deployment patterns and a metrics/logs/traces stack (e.g., Prometheus, Loki, Tempo) built to be tenant-aware across hybrid environments.
• Leadership & Independence: Sets technical direction, defends architecture choices (e.g., node pool strategy, partitioning, IAM boundaries), and prioritizes ruthlessly without needing a pre-built roadmap.
• Language: Fluent English. Works well directly within a small, fast-moving technical team.

Nice-to-haves

• GitOps Patterns: Experience with multi-cluster management and GitOps workflows (e.g., ArgoCD, Flux) for deploying and maintaining workloads across multi-region or on-prem environments.
• Multi-tenant Regulated SaaS: Experience with compliance (finserv, healthcare, public sector), data residency, audit logging, and encryption-at-rest requirements.
• Integration/ESB Runtimes: Familiarity with engines like Apache Camel or durable-execution/workflow orchestration engines (e.g., Temporal.io).
• API Gateways: Rate limiting, mTLS termination, per-tenant quotas.
• AI/LLM Infrastructure: Basic familiarity with vector databases, self-hosted inference, or GPU node pools.

Tech stack

• Orchestration: Managed Kubernetes (EKS/GKE) + On-Prem/Lightweight K8s (K3s/Rancher)
• IaC & GitOps: Terraform, ArgoCD/Flux
• Messaging & Data: Apache Kafka (KRaft mode)
• Identity & Secrets: Keycloak (OIDC/RBAC), HashiCorp Vault
• Observability: OpenTelemetry, Prometheus, Loki, Tempo

We are looking forward to receiving your application, but please note, that only applicants with an EU citizenship or a valid residency/work permit will be considered for this role.

Great people rarely fit completely into job descriptions.

If you’re curious, driven, and excited by what we’re building, apply - even if your experience doesn’t match every bullet point.

Different perspectives make better ideas, stronger teams, and better outcomes for our customers.

Come build with us.