Senior Cloud Engineer at Heirs Holdings

The Role

• As a Senior Cloud Engineer, you will be a hands-on builder of the cloud infrastructure that powers Africa's most ambitious digital banking platform. You will design, provision, and operate a dual-cloud environment across AWS and Azure — ensuring it is always on, highly secure, infinitely scalable, and built entirely in code. You will work closely with architects, DevSecOps engineers, and application teams to deliver infrastructure that meets the highest standards of performance, resilience, and security.

What You'll Do

• Dual-Cloud Infrastructure — Design, provision, and maintain production-grade cloud infrastructure across both AWS and Azure — ensuring both environments mirror each other in architecture, connect reliably to the institution's on-premises Core Banking systems, and operate with no single point of vendor dependency.
• Infrastructure as Code — Define every environment — dev, staging, and production — in version-controlled IaC. Terraform, Ansible, and Bash are the approved tools for infrastructure provisioning and automation. No manual cloud provisioning. All environments must be reproducible, auditable, and spun up on demand.
• High Availability & Resilience — Architect and maintain highly available configurations across all services, databases, middleware, and storage — targeting 99.99% platform uptime. Implement circuit breakers, retry logic, auto-scaling, and graceful fallbacks so users never feel a backend failure.
• Private Networking & Zero Trust — Own the platform's private network architecture — ensuring every cloud environment is isolated, segmented, and built on the principle that no internal service is ever publicly reachable. Design and maintain the full private networking stack across AWS and Azure: VNets, dedicated subnets, NSGs, private DNS, and private endpoints for all managed services. Enforce zero-trust principles across all internal communication — no implicit trust, every request authenticated and authorised. Public internet exposure is limited strictly to approved entry points: Cloudflare DDoS → WAF → API Gateway.
• Auto-Scaling & Cost Efficiency — Own the platform's approach to scalability and cloud cost efficiency — ensuring infrastructure responds dynamically to demand and never carries unnecessary cost. Configure services to scale to zero at idle and scale out at peak without manual intervention. Continuously monitor and optimise cloud resource consumption — ensuring no environment is over-provisioned and every element of platform spend is lean and justified.
• Managed Services & Platform Stack — Provision and operate the platform's managed cloud services — including PostgreSQL (Azure Database for PostgreSQL, Amazon RDS/Aurora), Apache Cassandra (Azure Managed Instance, Amazon Keyspaces), Redis, RabbitMQ/Azure Service Bus/Amazon SQS, and Kong API Gateway.
• Secrets & Key Management — Manage all secrets, certificates, and encryption keys through Azure Key Vault, AWS Secrets Manager, or equivalent secrets management platform. Enforce rotation schedules. Ensure no credential is ever hardcoded in application code, configuration files, or container images.
• Security & Compliance — Implement and maintain cloud security controls — including AES-256 encryption at rest, TLS 1.2+ in transit, DLP monitoring for abnormal data transfer and unauthorised export, and alerting on policy changes or attempts to disable logging. Contribute to PCI DSS and CBN compliance posture.
• Observability — Instrument cloud infrastructure with centralised logging, metrics, and alerting from day one. Ensure every layer of the infrastructure stack is fully visible — no blind spots in production.
• CI/CD Integration — Integrate cloud infrastructure provisioning into DevSecOps pipelines — ensuring infrastructure changes flow through the same automated, security-gated pipelines as application code.

What We're Looking For

Must Have

• 5+ years of hands-on cloud engineering experience at scale, with production deployments on both AWS and Azure — including compute, networking, storage, managed databases, and messaging services.
• Expert-level Infrastructure as Code skills — Terraform, Ansible, and Bash, with a strong understanding of state management, module design, and CI/CD-integrated provisioning workflows.
• Deep experience designing and operating private, secure cloud network architectures — VNets, NSGs, private endpoints, private DNS, VPNs, and zero-trust network segmentation.
• Strong understanding of cloud security fundamentals — encryption (AES-256, TLS 1.2+), key management (Azure Key Vault, AWS KMS), identity and access management, and least-privilege access controls.
• Hands-on experience with containerised workloads — Docker, Kubernetes or equivalent orchestration platforms on managed cloud services (AKS, EKS), and serverless container platforms including Azure Container Apps and AWS App Runner / ECS Fargate.
• Working knowledge of high-availability patterns — multi-region deployments, auto-scaling, load balancing, circuit breakers, and disaster recovery design.
• AWS Certified Solutions Architect – Professional (SAP-C02) — required.

Nice to Have

• Microsoft Certified: Azure Solutions Architect Expert (AZ-305) — strongly preferred as the platform expands to dual-cloud.
• Experience with serverless compute platforms — Azure Functions and/or AWS Lambda — for event-driven, lightweight processing workloads.
• Experience with the platform's managed services stack: Azure Database for PostgreSQL, Amazon RDS/Aurora, Azure Managed Instance for Apache Cassandra, Amazon Keyspaces, Azure Service Bus, Amazon SQS, or Redis.
• Familiarity with Cloudflare (DDoS protection, WAF) and API gateway configuration (Kong or equivalent).
• Experience in fintech, banking, or regulated cloud environments — with working knowledge of PCI DSS, CBN guidelines, or equivalent data residency and compliance requirements.
• Cloud cost management experience using FinOps tooling or native cloud cost monitoring and optimisation features.