Lead Platform Engineer (AWS)

At Wyden (Permanent), in
Expires at: 2027-10-09
Remote policy: Full remote
Wyden is the leading provider of institutional digital asset trading technology to financial institutions. We are a collaborative and laser-focused team of leaders and engineers committed to building advanced, scalable and modular trading infrastructure that underpins our clients' digital asset product offerings and operations.Today, dozens of banks, brokers, and financial service institutions rely on Wyden's products. Digital assets are now a mainstream asset class, and financial institutions are fast adopting digital assets in response to digital asset regulations around the globe.If you are passionate about the institutional digital asset ecosystem, thrive on solving complex infrastructure challenges at scale, and want to be the technical authority who keeps mission-critical production environments running reliably across a growing roster of global financial institutions, Wyden is the home for you.
Established in Zurich, Switzerland, Wyden also has a development hub in Poland.
About the role
The Senior Cloud Platform Engineer is the AWS architecture authority for Wyden's Run function — the most senior technical individual contributor in production operations. This role sits within Customer Success & Operations, reporting directly to the Head of Run, and is the engineering backbone on which every customer environment, deployment, and operational system depends.
This is not a pure operational support role and it is not a management role. It is a senior technical leadership position: you own the infrastructure architecture, you set the DevOps standards, and you build the systems that allow the broader Run team to operate with confidence. You will also recruit, onboard, and technically lead a junior SRE — defining what good looks like and building toward genuine team capability.
The Senior Cloud Platform Engineer will work in close daily proximity to the CTO and Head of Customer Success — involved in architectural reviews, compliance discussions, and operational governance decisions at a level that benefits significantly from being in the room.
The deep AWS and DevOps execution that was previously concentrated in a single interim contractor is now formally owned by this role. Wyden's customer base is growing toward 20+ live environments. The infrastructure must scale with it — reliably, automatically.
We will only consider candidates based in the Lisbon region.
Your responsibilities will include:
1. AWS architecture & cloud infrastructure design
Own the AWS architecture for all Wyden customer environments — multi-tenant and single-tenant — ensuring designs are scalable, secure, cost-efficient, and operationally maintainable
Design and govern the infrastructure patterns that the Run team and junior SRE operate within: VPC design, EKS cluster architecture, Aurora/RDS configurations, IAM policies, networking (VPN, PrivateLink, Transit Gateway, Direct Connect)
Lead infrastructure architectural reviews with the CTO, ensuring production decisions are technically sound and aligned with the platform roadmap
Identify and address infrastructure risk proactively — before incidents occur, not in response to them
Own AWS cost management: rightsizing, reserved instance strategy, architecture optimisations that reduce spend as the environment footprint grows
2. Infrastructure as Code & DevOps automation
Own all IaC for customer AWS deployments: design, write, test, and maintain Terraform and Terragrunt modules that are reusable, version-controlled, and reproducible across all environments
Design, build, and own Wyden's CI/CD pipelines for infrastructure and application deployment: GitLab CI, GitHub Actions, and AWS CodePipeline — not just using pipelines but architecting them from the ground up
Automate deployment, validation, and rollback processes to the point where routine deployments require minimal human intervention and carry low operational risk
Define and enforce DevOps standards across the Run team: branching strategy, pipeline structure, deployment gates, environment promotion criteria, and release hygiene
Identify and eliminate manual operational steps through scripting and automation — Python, Bash, or equivalent — building a team that is systematically less dependent on individual knowledge
Continuously improve IaC coverage to eliminate configuration drift and manual provisioning across all customer environments
3. Monitoring, observability & alerting automation
Design and own Wyden's full observability stack: AWS CloudWatch, Prometheus, Grafana, Sign4l, OpenSearch — ensuring complete visibility into every customer environment before customers report issues
Build monitoring templates that are reusable across environments, reducing the cost of onboarding new customers to production
Define SLOs and SLAs with the Head of Run; build the alerting infrastructure that makes breaches visible and actionable in real time
Tune alerting continuously to reduce noise and surface only actionable signals — a noisy alert system is an ignored alert system
Build and own automated reporting infrastructure: environment health dashboards, SLA metrics, incident summaries, and capacity trend data for both internal and customer-facing use
4. Application deployments & release engineering
Own deployment execution for application releases, infrastructure upgrades, and configuration changes across all customer environments
Build and maintain deployment runbooks that are standardised, low-risk, reversible, and executable by other team members — not just by the Senior SRE
Define pre-deployment validation checklists and automated gates that reduce last-minute surprises and deployment failures
Coordinate with Engineering and the Head of Run on release handovers: ensuring production environments are validated and ready before go-live decisions are made
Own the deployment pipeline architecture: from code commit to production — including build, test, staging validation, and production promotion
5. Customer platform migrations
Lead the technical execution of customer migrations from Wyden's legacy platform (Everyware) to the current NG environment — working in partnership with the Engineering DevOps team
Design and own the migration infrastructure: environment provisioning templates, data migration tooling, validation frameworks, and cutover runbooks
Build reusable migration automation that accelerates each successive customer migration and reduces manual execution risk
Ensure monitoring, alerting, and operational runbooks are fully in place for newly migrated environments from day one of production handover
Manage migration risk: define go/no-go criteria, maintain rollback capability, and ensure CS teams are operationally prepared before each cutover
6. Junior SRE leadership & team development
Recruit, onboard, and technically lead the junior SRE — actively involved in defining the role requirements, conducting technical screening, and selecting the right candidate
Set the technical standards the junior SRE operates within: code review, IaC standards, pipeline conventions, documentation requirements, and operational procedures
Build toward genuine team independence — the junior SRE should be progressively handling more operational execution, with the Senior SRE moving to architecture and governance
Work closely with the Head of Run to bridge the AWS knowledge gap: proactively sharing infrastructure context, explaining architectural decisions, and building the Head of Run's confidence in governing infrastructure choices
Contribute to the wider team's capability: support Infra Support Engineers as they develop AWS knowledge, and ensure operational knowledge is documented rather than held individually
7. Operational documentation & compliance
Own infrastructure documentation for all customer environments: architecture diagrams, runbooks, deployment guides, and environment-specific operational notes
Contribute to ISO 27001 and SOC 2 compliance evidence: infrastructure controls documentation, security patch records, access management logs, and audit-ready operational records
Ensure all infrastructure decisions, architecture patterns, and operational procedures are documented and accessible to the full Run team — building institutional knowledge, not a personal knowledge silo
The ideal candidate would bring:
Must have
Proven, production-depth AWS expertise across the full infrastructure stack: EKS (Kubernetes), Aurora/RDS, Lambda, VPCs, IAM, S3, CloudWatch, Route 53, and AWS networking services (VPN, PrivateLink, Transit Gateway) — not familiarity, daily hands-on depth
Senior-level Infrastructure as Code experience: Terraform and Terragrunt in production, writing and maintaining modular, tested, reusable IaC at scale across multiple environments
CI/CD pipeline design and ownership: GitLab CI, GitHub Actions, AWS CodePipeline or equivalent — built pipelines from scratch, not just used them
Kubernetes operations at depth: EKS cluster design, workload deployment, scaling, upgrade management, and troubleshooting in production multi-tenant environments
Strong scripting and automation: Python, Bash or equivalent — builds automation tooling, not just scripts individual tasks
Monitoring and observability stack ownership: CloudWatch, Prometheus, Grafana, and equivalent — has designed and owned a full observability stack, not just configured dashboards
Excellent written and spoken English: able to produce clear architecture documentation, conduct technical discussions with a CTO, and communicate infrastructure risk to operational and CS teams. Evidence of such documents to be requested in interview process.
Strong assets
AWS certification at professional level: AWS Certified Solutions Architect Professional, AWS Certified DevOps Engineer Professional, or AWS Certified SysOps Administrator — strong preference for at least one professional-level certification. Similar certifications on other hyperscale infrastructure (MS Azure, GCP, IBM Cloud...) are a plus.
SaaS or multi-tenant platform experience: operational complexity of managing customer-specific environments on shared infrastructure, where one change can impact multiple clients
Financial services or regulated industry background: familiarity with ISO 27001, SOC 2, or equivalent compliance frameworks from an infrastructure design and evidence perspective
Migration experience: designed and executed platform migrations at scale, including environment provisioning, data migration tooling, validation frameworks, and cutover management
AWS networking depth: VPN connectivity, Direct Connect, AWS PrivateLink, Transit Gateway — particularly valuable for Wyden's complex single-tenant customer integrations
Experience mentoring or technically leading junior engineers: setting standards, conducting code review, and building team capability without becoming a bottleneck
Database operations at depth: Aurora/RDS design, backup and recovery, performance tuning, and upgrade execution for production financial-grade databases
DevSecOps experience: security scanning in pipelines, compliance automation, secrets management (AWS Secrets Manager, HashiCorp Vault), and infrastructure security hardening
The right mindset
Architecture thinking: you design systems that scale and stay maintainable, not just solutions that work today
Automation-first: your instinct is always to eliminate the manual step, not to do it faster
Builder of team capability: you write documentation, set standards, and build systems so others can operate independently — you are not the bottleneck
Reliability-focused: you think in terms of SLOs, failure modes, blast radius, and recovery time — not just delivery
Calm and systematic under pressure: production incidents are solved methodically, with clear communication, not heroics
Collaborative across functions: you work comfortably with a CTO on architecture, with a Head of Run on operational governance, and with CS teams on customer impact — adapting your communication register appropriately
Benefits & Perks
What Wyden offers
An opportunity to be the technical authority for production infrastructure at one of the world's leading institutional digital asset trading platforms
Competitive salary and benefits package
Flexible and remote working policies
Career development opportunities in a fast-growing fintech at the centre of a global industry shift
An open and dynamic environment where technical excellence is valued and infrastructure quality directly impacts business outcomes
A team of professionals with expertise spanning banking, trading, software, and systems development