Cloud Application Architect

Mission. Design and own how the platform runs on AWS: from a single host with Docker Compose to ECS across three availability zones, Aurora PostgreSQL, Valkey, zero-downtime deploys and autoscaling, and later a second region. You decide task sizes and memory limits, how gunicorn and Celery are laid out, how the database moves without a maintenance window, and how the whole thing fails over. You are hands-on in Terraform and pipelines, and you partner with the SRE team that operates what you design.

Reports to the Head of Platform and Reliability

What you will own
Runtime architecture for the Django API and the Celery workers on ECS: task sizing, CPU and memory limits, worker and thread topology, health checks, graceful shutdown, rolling or blue-green deploys.
The data tier: RDS to Aurora migration with near-zero downtime, RDS Proxy and IAM authentication, read replicas, backups, point-in-time recovery, cross-region replication.
Cache and messaging: Redis to Valkey on ElastiCache with replication; SQS and dead-letter queue hygiene; Kinesis capacity and consumer concurrency.
Edge and network: ALB and NLB, WAF in block mode, per-merchant rate limiting, TLS, VPC design, private connectivity to providers, a multi-account landing zone with Organizations and SSO.
Operations of the serverless estate: Lambda reserved and provisioned concurrency, canary deployments with alarms, dead-letter queues on every asynchronous path.
Infrastructure as code and delivery: Terraform modules, GitHub Actions pipelines, environment parity, drift detection, rollback.
Observability and cost: the Datadog APM rollout with the SRE team, SLO dashboards, capacity and cost visibility, Savings Plans and right-sizing.
Resilience: load tests at 10x and 30x, game days, the disaster recovery plan with a tested runbook, the second-region design.




PCI DSS infrastructure controls with the CISO: segmentation, hardening, logging, key management.
How you will work
Design it, build the first version yourself with the SRE team, then hand it over with a runbook.
Every production change goes through code review and a Terraform plan; no console changes.
Join the platform on-call rotation after your first quarter.
Work in Spanish and English with a distributed team across the Americas.
Cloud Application Architect: what we need from you

Must have
7+ years in engineering, at least 3 of them architecting production workloads on AWS that could not go down.
ECS on EC2 and Fargate, or Kubernetes, in production with containerized Python applications; you know what gunicorn and Celery do under memory pressure.
Terraform at module level, with remote state, workspaces and plans in CI.
Aurora or RDS PostgreSQL operations and migrations: replication, parameter tuning, connection pooling, upgrades without downtime.
ElastiCache or Valkey, SQS, Kinesis, Lambda, DynamoDB, API Gateway.
ALB, NLB, WAF, Route 53, CloudFront, VPC design, IAM and multi-account governance with service control policies.
Linux and container debugging: out-of-memory behavior, cgroups, page cache and swap, I/O saturation, network timeouts.
Datadog or equivalent: APM, logs, metrics, synthetics, SLOs.
GitHub Actions or similar; Python and Bash for automation.
Has run at least one zero-downtime migration of a database or a runtime in production.
Has worked inside PCI DSS or SOC 2 scope and knows what the auditor asks for.
Professional Spanish and English.
Nice to have
AWS Solutions Architect Professional or DevOps Engineer Professional.
Multi-region disaster recovery on AWS that was actually tested.
Kubernetes, FinOps practice, incident command experience.
Payments or fintech background.

📌 Cloud Application Architect (Ciudad de México)
🏢 Tonder
📍 Ciudad de México