DevOps Engineer - AWS, CI/CD and Security

About the role

A full-time, onsite DevOps Engineer is needed in Nairobi to own the company's AWS environment, its CI/CD pipelines and its security posture, carrying the operational load so product engineers can keep shipping. The role is hands-on and has real ownership: you decide how the company builds, deploys, monitors and secures what it runs.

Key responsibilities

• Own and operate the AWS environment (EC2, VPC, IAM, S3, RDS, ElastiCache, load balancers, Route 53, CloudFront), moving to a clustered, load-balanced, auto-scaling architecture and defining infrastructure as code with Terraform or CloudFormation.
• Own the CI/CD pipelines for Laravel (PHP), Node.js and Flutter, automate build, test, release and rollback, containerise services with Docker, set up mobile release pipelines to the app stores and unblock developers.
• Harden the infrastructure behind the payments product: least-privilege access, secrets management, encryption, network segmentation, WAF and DDoS protection, vulnerability scanning and patch management, and support for security assessments and penetration testing.
• Build monitoring, logging and alerting with Sentry and CloudWatch, run the on-call rotation, lead incident response and post-incident reviews, and manage backups and disaster recovery.
• Track and reduce cloud spend, document architecture and runbooks, review infrastructure code and coach the team on secure defaults.

Required profile

• Bachelor's degree in Computer Science, Information Technology, Software Engineering, Information Security or a related field.
• 5+ years of professional experience in DevOps, site reliability, platform or cloud infrastructure engineering on production systems.
• Preferred: fintech or financial services experience, exposure to streaming or real-time media infrastructure, and experience with multi-tenant infrastructure.

Required skills

• Strong AWS experience (EC2, VPC, IAM, S3, RDS, CloudWatch, Secrets Manager, WAF, security groups).
• Infrastructure as code with Terraform or CloudFormation; Docker in production, with ECS, EKS or Kubernetes.
• CI/CD with GitLab CI, GitHub Actions or Bitbucket Pipelines.
• Linux administration, Nginx, PHP-FPM, MySQL and Redis; Bash scripting, and Python or Go.
• Application and network security (TLS, key management, IAM, vulnerability management) and Git.
• Preferred: PCI DSS, ISO 27001, SOC 2, AWS certifications, CISSP or OSCP.