Cloud Application Architect

Mission. Design and own how the platform runs on AWS: from a single host with Docker Compose to ECS across three availability zones, Aurora PostgreSQL, Valkey, zero-downtime deploys and autoscaling, and later a second region. You decide task sizes and memory limits, how gunicorn and Celery are laid out, how the database moves without a maintenance window, and how the whole thing fails over. You are hands-on in Terraform and pipelines, and you partner with the SRE team that operates what you design.

Reports to the Head of Platform and Reliability

What you will own

- Runtime architecture for the Django API and the Celery workers on ECS: task sizing, CPU and memory limits, worker and thread topology, health checks, graceful shutdown, rolling or blue-green deploys.
- The data tier: RDS to Aurora migration with near-zero downtime, RDS Proxy and IAM authentication, read replicas, backups, point-in-time recovery, cross-region replication.
- Cache and messaging: Redis to Valkey on ElastiCache with replication; SQS and dead-letter queue hygiene; Kinesis capacity and consumer concurrency.
- Edge and network: ALB and NLB, WAF in block mode, per-merchant rate limiting, TLS, VPC design, private connectivity to providers, a multi-account landing zone with Organizations and SSO.
- Operations of the serverless estate: Lambda reserved and provisioned concurrency, canary deployments with alarms, dead-letter queues on every asynchronous path.
- Infrastructure as code and delivery: Terraform modules, GitHub Actions pipelines, environment parity, drift detection, rollback.
- Observability and cost: the Datadog APM rollout with the SRE team, SLO dashboards, capacity and cost visibility, Savings Plans and right-sizing.
- Resilience: load tests at 10x and 30x, game days, the disaster recovery plan with a tested runbook, the second-region design.




- PCI DSS infrastructure controls with the CISO: segmentation, hardening, logging, key management.

How you will work

- Design it, build the first version yourself with the SRE team, then hand it over with a runbook.
- Every production change goes through code review and a Terraform plan; no console changes.
- Join the platform on-call rotation after your first quarter.
- Work in Spanish and English with a distributed team across the Americas.

Cloud Application Architect: what we need from you

Must have

- 7+ years in engineering, at least 3 of them architecting production workloads on AWS that could not go down.
- ECS on EC2 and Fargate, or Kubernetes, in production with containerized Python applications; you know what gunicorn and Celery do under memory pressure.
- Terraform at module level, with remote state, workspaces and plans in CI.
- Aurora or RDS PostgreSQL operations and migrations: replication, parameter tuning, connection pooling, upgrades without downtime.
- ElastiCache or Valkey, SQS, Kinesis, Lambda, DynamoDB, API Gateway.
- ALB, NLB, WAF, Route 53, CloudFront, VPC design, IAM and multi-account governance with service control policies.
- Linux and container debugging: out-of-memory behavior, cgroups, page cache and swap, I/O saturation, network timeouts.
- Datadog or equivalent: APM, logs, metrics, synthetics, SLOs.
- GitHub Actions or similar; Python and Bash for automation.
- Has run at least one zero-downtime migration of a database or a runtime in production.
- Has worked inside PCI DSS or SOC 2 scope and knows what the auditor asks for.
- Professional Spanish and English.

Nice to have

- AWS Solutions Architect Professional or DevOps Engineer Professional.
- Multi-region disaster recovery on AWS that was actually tested.
- Kubernetes, FinOps practice, incident command experience.
- Payments or fintech background.

📌 Cloud Application Architect (Ciudad de México)
🏢 Tonder
📍 Ciudad de México