Head Hunters
Infrastructure Engineer Lead
A hands-on infrastructure lead who greenfield-builds the Kubernetes-native foundation — clusters, Terraform IaC, Kafka messaging, Keycloak/Vault identity and secrets, OpenTelemetry observability — for a client's multi-tenant product. Sets all architecture decisions now and builds/leads a team as it scales. Based in Pune.
- Compensation
- ₹2.5M–₹4M / yr
- Location
- Pune
- Work setup
- Hybrid
- Seniority
- Lead
- Employment
- Full time
- Experience
- 8+ years
- Category
- Devops
- Posted
Skills
Must have
- 8+ years owning production infrastructure end-to-end at a startup or scale-up, ideally as early/first infra hire
- Kubernetes expertise: managed (EKS/GKE) and self-hosted/on-prem (K3s, Rancher, OpenShift); namespace-per-tenant, ResourceQuota/LimitRange, default-deny NetworkPolicy, Pod Security Admission, autoscali
- Hybrid networking: VPNs, mTLS, reverse proxies, WireGuard between cloud control planes and on-prem nodes
- Terraform/IaC: modular design, remote state with locking, state-splitting for blast-radius control
- Apache Kafka production experience (ideally KRaft mode): broker sizing, replication/AZ placement, Schema Registry, DLQ/DLT, retry topology
- Identity & secrets infrastructure: OIDC/RBAC provider (e.g., Keycloak) with per-tenant realms; secrets manager (e.g., Vault) with Kubernetes-native auth
- CI/CD: pipelines (e.g., GitHub Actions), lint/test/build/push/deploy flows, OIDC-based cloud auth, secret-scanning pre-commit hooks
- Observability: OpenTelemetry Collector deployment and tenant-aware metrics/logs/traces stack (e.g., Prometheus, Loki, Tempo)
- Leadership & independence: sets technical direction, defends architecture choices, prioritizes without a pre-built roadmap
- Fluent English; works well in a small, fast-moving technical team
Nice to have
- GitOps patterns: multi-cluster management and GitOps workflows (e.g., ArgoCD, Flux)
- Multi-tenant regulated SaaS compliance (finserv, healthcare, public sector), data residency, audit logging, encryption-at-rest
- Integration/ESB runtimes: Apache Camel or durable-execution/workflow engines (e.g., Temporal.io)
- API gateways: rate limiting, mTLS termination, per-tenant quotas
- AI/LLM infrastructure: vector databases, self-hosted inference, GPU node pools
Full description
A hands-on infrastructure lead who owns the Kubernetes-native foundation for our client's Products. This covers the cluster, IaC, secrets, identity, messaging, and observability.
This is a greenfield build. There's no legacy infra and no existing conventions to inherit. Every foundational decision gets made once, by this person, and lived with for years. That takes someone senior enough to set direction and own it. As we scale, this person will build and lead a team. Right now, the focus is architecture. The person writes the Terraform, configures the cluster, debugs the Kafka broker.
The infra has to cover several key pillars from day one:
- Tenant Isolation: Namespace-per-tenant, default-deny network policy, per-tenant secrets, and identity realms.
- Hybrid & On-Prem Deployment: Hosting central control planes in the cloud while supporting deployment across on-premises or private cloud customer environments.
- Durability & Messaging: Kafka as the backbone for event-driven components.
- EU Data Sovereignty: Region, encryption, audit trails, and self-hosted vs. managed choices that hold up under GDPR and EU AI Act rules.
- Observability: Every span, log, and metric traceable per tenant across all deployed environments.
-
Must-haves
- 8+ years of experience owning production infrastructure end-to-end at a startup or scale-up. Ideally as an early or first infra hire with full accountability.
- Kubernetes Expertise (Managed & On-Prem): Strong experience with cloud-managed K8s (EKS/GKE) as well as self-hosted, bare-metal, or lightweight distributions (e.g., K3s, Rancher, OpenShift) for on-premise setups. Deep grasp of namespace-per-tenant patterns, ResourceQuota/LimitRange, NetworkPolicy (default-deny), Pod Security Admission, and autoscaling.
- Hybrid Networking & Connectivity: Experience with secure cross-environment networking (VPNs, mTLS, reverse proxies, WireGuard) to establish reliable communication between cloud control planes and on-premise execution nodes.
- Terraform / IaC: Modular design (network / cluster / IAM / tenant-namespace / addons), remote state with locking, and state-splitting for blast-radius control. Treats IaC as a long-lived codebase.
- Apache Kafka: Production experience (ideally KRaft mode). Broker sizing, replication/AZ placement, Schema Registry, DLQ/DLT, and retry topology.
- Identity & Secrets Infrastructure: An OIDC/RBAC identity provider (e.g., Keycloak) with per-tenant realm patterns. A secrets manager (e.g., Vault) with Kubernetes-native auth and zero-hardcoded-secrets enforcement.
- CI/CD: Practical experience with pipelines (e.g., GitHub Actions), lint/test/build/push/deploy flows, OIDC-based cloud auth, and secret-scanning pre-commit hooks.
- Observability Infrastructure: OpenTelemetry Collector deployment patterns and a metrics/logs/traces stack (e.g., Prometheus, Loki, Tempo) built to be tenant-aware across hybrid environments.