Head of Infrastructure, DevOps & SRE

Head of Infrastructure, DevOps & SRE

 Location

Europe (remote-first) - occasional travel to Riga / Nairobi

 Reports to

Chief Technology Officer (CTO)

 Team size

7-person team

 Hire type

New hire

 Peers

Head of Engineering, Digital Experience  ·  Head of Engineering, Platform  ·  Head of IT  ·  Heads of Product

 Tech stack

AWS + on-prem hybrid  ·  Kubernetes (EKS + on-prem K8s)  ·  GitHub Actions  ·  Terraform

 About Watu

Watu is a fintech company operating across Africa and Latin America, providing device financing and financial services to customers who have historically been excluded from the formal financial system. We finance motorcycles, smartphones and other productive assets through a technology-first, data-driven approach - enabling customers to own income-generating assets and build credit histories.

 Our technology platform supports millions of customer journeys across markets in Kenya, Uganda, Tanzania, DRC, and beyond, with continued expansion into LATAM. The infrastructure underpinning that platform is the foundation everything else is built on - and this role owns it.

The Role

This is a senior leadership hire that owns the entire deployment substrate at Watu. You will lead a 7-person Infrastructure, DevOps & SRE team responsible for cloud infrastructure, on-premises systems, Kubernetes operations, CI/CD pipelines, site reliability, and security engineering.

 The team is already designed - you are inheriting a defined structure and will immediately take ownership of it. Your first priority is standing it up, hiring the open positions, and asserting technical authority over the infrastructure layer across all engineering functions.

 You will report directly to the CTO and be a peer to the two Heads of Engineering. The clean boundary you are responsible for is: Infrastructure, DevOps & SRE owns the deployment substrate; the engineering squads build on top of it. Defending and maintaining that boundary is part of the job.

 This role is remote-first in Europe, reflecting where the existing Riga-based infrastructure team sits. You will travel occasionnally to Nairobi for market presence and to Riga for team operations. You will be expected to be fully available across both Central European and East African time zones during critical periods.

What You Will Own

Cloud & on-premises infrastructure

• Own the AWS cloud environment end-to-end: account structure, VPCs, IAM, cost optimisation, and architectural governance across all environments.
• Manage on-premises infrastructure in local markets alongside the cloud layer - hybrid architecture is a reality, not a transition state.
• Own the Kubernetes fleet: EKS in AWS and on-prem K8s clusters. Cluster lifecycle management, upgrades, autoscaling, workload isolation, and cost allocation.
• Exit (or reduce to pure added capacity only) the existing partner dependency and take full ownership of infrastructure operations - this is an explicit objective for the first 6 months.

CI/CD and developer platform

• Own CI/CD infrastructure for all engineering squads (8 squads across CXE and Platform Engineering). GitHub Actions is the standard - you govern the pipelines, environments, and deployment patterns.
• Define and enforce deployment standards: environment promotion, feature flags, blue-green or canary patterns, rollback procedures.
• Act as the internal platform team for infrastructure concerns - squads should be able to deploy confidently without becoming infrastructure experts.
• Drive automation-first thinking: if a process is manual and repeatable, it should be automated. Infrastructure-as-code (Terraform or equivalent) is non-negotiable.

Site reliability & on-call

• Own SLOs, SLAs, and error budgets across all production services. Define them in collaboration with engineering squads; hold the line on them operationally.
• Build and operate the on-call rotation for L3 escalations from the L2 Operations Center. L3 engineers come from the squads - you govern the process, tooling, and runbooks that make the rotation viable.
• Own incident response infrastructure: alerting, observability tooling (Prometheus/Grafana, or equivalent), and the post-incident review process.
• Drive MTTR down over time - not through heroics, but through better observability, automated remediation, and runbook discipline.

Networking & connectivity

• Own networking across all environments: VPCs, VPNs, peering, private connectivity to payment providers and third-party integrations.
• Manage connectivity to local market infrastructure - call systems, local monitoring agents, and market-specific network requirements are your problem to solve alongside the Head of IT.
• Own DNS, certificate management, and API gateway infrastructure.

Security engineering

• Own infrastructure security: secrets management (AWS Secrets Manager or Vault), IAM least-privilege enforcement, network security groups, and vulnerability scanning at the infrastructure layer.
• Ensure OWASP compliance at the infrastructure level; own dependency scanning, container image scanning, and penetration testing cadence.
• Work with the Head of IT to ensure local market infrastructure and IT systems meet the same security baseline as the cloud platform.

Team and people

• Lead and develop the 7-person team: Lead DevOps Engineer, Senior Cloud Infrastructure Engineer, SRE/Cloud Security Engineer, Infrastructure & Network Engineer, two DevOps/Platform Engineers (Riga and Brazil).
• The Brazil hire provides LATAM timezone coverage and Africa off-hours backup - building and managing a distributed team across 3 continents is part of the job.
• Be the technical authority your team needs: available for escalation, capable of diving into the hardest infrastructure problems personally, and consistently raising the bar.

Who You Are

Essential

• 8+ years of infrastructure and DevOps engineering experience, with at least 3 years in a senior technical leadership role owning a production cloud environment at scale.
• Deep AWS expertise - not just familiarity. You can architect, cost-optimise, secure, and operate a complex AWS environment across multiple accounts and regions.
• Kubernetes at production depth: cluster operations, workload scheduling, autoscaling, networking (CNI, service mesh), storage, and multi-cluster management.
• CI/CD engineering leadership: you have designed and owned GitHub Actions (or equivalent) pipelines for multiple engineering teams, and you understand the developer experience implications of every infrastructure decision.
• SRE practice: you have defined and maintained SLOs, built on-call rotations, owned incident response tooling, and driven MTTR improvement through systematic means.
• Infrastructure-as-code is second nature: Terraform at production scale, GitOps patterns, environment promotion pipelines.
• Experience managing distributed infrastructure teams across multiple timezones - you have done this and it has worked.
• Security-first mindset: you treat IAM, secrets management, network segmentation, and vulnerability management as first-class engineering concerns, not compliance checkboxes.

Strongly preferred

• Experience with hybrid cloud/on-premises architectures - you have managed infrastructure that spans cloud and physical environments simultaneously.
• Fintech or payments infrastructure background - you understand the reliability, security, and compliance requirements of systems that move money.
• Experience exiting a managed infrastructure provider dependency and taking full ownership of operations in-house.
• Familiarity with African market infrastructure constraints: connectivity variability, local cloud presence limitations, latency to global providers.
• Experience with observability tooling at depth: Prometheus/Grafana, or equivalent - not just setup, but instrumentation strategy and alerting discipline.
• Exposure to payment provider connectivity: private peering, dedicated connectivity, or VPN architecture for financial integrations.

The kind of person we are looking for

• You hold the line on infrastructure quality. Squads want to move fast - your job is to make fast safe, not to be the person who says no.
• You are comfortable being the person who carries a pager. You would not ask your team to be on-call for something you would not be on-call for yourself.
• You communicate clearly across technical and non-technical audiences. When something is down, the CTO and the business need to understand what is happening and why.
• You think about the cost of every architecture decision - cloud spend is real and you treat it like it is your own money.
• You are not precious about tooling. The best tool for the job is the one that solves the problem reliably and your team can operate confidently.
• You are genuinely excited about AI/LLM tooling for infrastructure automation - runbook generation, incident triage, IaC authoring - and you model that for your team.

Infrastructure Context

Some important context about where we are today and what you are walking into:

• We want to operate a hybrid AWS + on-premises environment. The on-prem layer is not going away - local market infrastructure for call systems and monitoring is a permanent part of the architecture.
• We are in the process of exiting or reducing our dependency with our existing partner, our current managed infrastructure provider. Taking full operational ownership of the infrastructure layer is an explicit objective for this hire.
• The Kubernetes environment will span EKS in AWS and on-prem K8s. Both will need active management.
• CI/CD pipelines exist but are not standardised across all squads. Imposing a consistent standard across 8 engineering squads is one of your first-year deliverables.
• The L2 Operations Center (platform monitoring, incident management, change management) sits under the Head of IT. You will be the primary L3 escalation target from the L2 team and you own the runbooks and tooling that make L3 escalation viable.
• Security engineering at the infrastructure layer is currently distributed and inconsistent. You will establish the baseline and own it.

What We Offer

• Direct CTO report - your decisions about infrastructure architecture have immediate organisational weight.
• A team that is already designed and partially staffed. You are not starting from zero - you are starting from a running start.
• Real technical challenge: hybrid cloud at scale, multi-continent team, emerging market infrastructure constraints, payments-grade reliability requirements.
• A mission that matters. Infrastructure quality at Watu directly affects whether millions of customers can make payments, unlock their devices, or access their loan accounts. Reliability is not abstract.
• Competitive salary, benefits, and long-term incentive participation commensurate with a senior leadership role in a growing fintech.
• Remote-first flexibility with the expectation of regular in-person presence in Nairobi and Riga.

How to Apply

Send your CV and a short note on your most relevant infrastructure leadership experience to the Watu talent team. We run a structured process: an initial conversation with the CTO, a deep technical interview covering infrastructure architecture and SRE practice, and a final conversation with the broader leadership team.

 We are an equal opportunity employer. We actively work to build a team that reflects the diversity of the markets and communities we serve.

All personal information provided will be processed in accordance with applicable data protection laws and regulations and used solely for recruitment and selection purposes. 

 Watu  ·  Technology Organisation  ·  Head of Infrastructure, DevOps & SRE