Senior Network Engineer

ABOUT THE ROLE Share is building an open-access internet infrastructure network across Africa. We aggregate fiber, transit, peering, and data-center capacity and make it available to ISPs on a shared physical network, so they can spin up or scale without building their own backbone. The product we’re building lets ISPs on top of us deliver speeds up to 100x the current market average — at no additional cost to them. Hitting that bar isn’t a marketing claim; it’s a technical commitment. We’re hiring a Senior Network Engineer to help run and scale that network. This is a deep ISP role, and it’s also a partner-facing one: you’ll spend a meaningful share of your time working directly with our ISP partners. Every partner shows up with their own history, vendor mix, and quirks, and the job is to bring each one from wherever they walked in to the baseline our network needs in order to deliver the speeds we know they can offer. WHAT YOU’LL ACTUALLY DO OWN THE ROUTING AND PEERING CORE

• Run and evolve our BGP edge on AS329621 — IP transit with Workonline, WIOCC, MTN/Bayobab, Afr-IX, Skytrend, plus public and private peering at KIXP and LINX, and PNIs with the hyperscalers.
• Design and maintain filter chains, route policy, communities, RPKI, and traffic-engineering logic across BR01/BR02 and downstream.
• Build and operate MPLS in the backbone — L3VPN and EVPN for partner isolation, services delivery, and future multi-tenant scale.
• Establish new peering arrangements (content, CDN on-nets, cache fills) and tune them for cost, performance, and resilience. OWN THE AGGREGATION AND SWITCHING LAYER
• Run our disaggregated, white-box switching fabric — modern network operating systems running on commodity silicon (SONiC, IP Infusion OcNOS, and similar), not vendor-locked CLIs.
• Design and operate L2/L3 aggregation: VLANs, MC-LAG/EVPN-VXLAN, QoS, and clean L2 hand-offs to partner ISPs.
• Operate our BNG edge at aggregation points — PPPoE/IPoE termination, QoS policies, CGNAT where needed, and CoA-driven session control that hooks into our AAA layer. OWN THE ACCESS AND PASSIVE LAYER
• Plan, deploy, and operate passive optical access — GPON and XGS-PON — including OLT configuration, ONU provisioning, and service profile design.
• Be comfortable with the fiber plant itself: ODF and splice planning, OTDR traces, loss budgets, and troubleshooting dark-fiber segments on our leased routes (KETRACO, KPC, Systel, and the ADC–iColo–PAIX metro ring).
• Integrate cleanly with partner equipment — many of our ISP partners run MikroTik (RouterOS / SwOS) and Huawei (GPON OLTs, access and aggregation). You should be able to sit on a call with a partner’s engineer and work the problem on their CLI as easily as ours. SUPPORT THE SERVICES PLANE
• Work alongside the Systems team, who own our AAA stack (FreeRADIUS proxy architecture, per-partner containerized instances, integration with partner billing systems like Splynx, and CoA relay for payment-driven session control). You won’t build that product, but you’ll be the network-side counterpart — making sure the BNG and aggregation layer speak cleanly to it, debugging session and accounting issues end-to-end, and feeding back real operational requirements.
• Own the network-layer services the AAA plane depends on: NAT/CGNAT, DHCP, IPAM, DNS, and IP/ASN planning — including IPv6 and dual-stack rollout.
• Monitor, measure, and debug: Zabbix, Grafana, flow telemetry, streaming telemetry where available, plus the usual toolkit — tcpdump, Wireshark, iperf, MTR.
• Work with our Systems and Dev teams on our source-of-truth (Nautobot) and config automation (Jinja-based generation), so the network is driven by data rather than by tribal knowledge. WORK DIRECTLY WITH OUR ISP PARTNERS
• A meaningful part of this role is partner-facing. You’ll sit on technical calls with our ISP partners, walk their networks with them, and help diagnose problems on the other side of our hand-off as readily as on our own side.
• Every partner comes to us from a different starting point — different vendors, different configurations, different habits. The job is to meet them where they are, help them get to the baseline our platform assumes, and then push their network past whatever ceiling they walked in with.
• Translate between ‘this is what we need to deliver 100x speeds on your network’ and ‘this is the concrete change on your OLT, your router, or your peering config tomorrow morning.’ OWN THE UPTIME
• Be on the hook for PoP and backbone reliability. Catch degradations before partners do, run clean post-mortems, and turn findings into automation and runbooks. WHO WE’RE LOOKING FOR We care much more about depth and judgment than about years on a résumé. The right person has been deep inside a real ISP and can move across layers without friction — physical, data-link, network, services — and knows how the pieces actually behave, not just how they’re drawn in a diagram. MUST-HAVE
• Senior-level experience inside an ISP or carrier — not just enterprise networking. You’ve lived with subscriber scale, partner hand-offs, and the economics of transit and peering.
• Strong BGP: route policy, communities, RPKI, route reflection, upstream/peer selection, traffic engineering, and the instincts to debug a leaky origin at 2am.
• Solid MPLS experience in production — L3VPN and ideally EVPN — including the control-plane details (LDP, SR, BGP address families) rather than just the config templates.
• Real operational experience with passive optical access — GPON or XGS-PON — including OLT/ONU provisioning and service modelling. If you haven’t run PON, you’ve at least operated an access network at comparable scale and understand the protocol stack.
• Comfortable in disaggregated / white-box environments — modern NOS stacks on commodity silicon (SONiC, IP Infusion OcNOS, or similar). You don’t need a vendor badge to operate a switch.
• Hands-on with MikroTik (RouterOS) and Huawei (access or core) — these are on our partners’ side of the fence and you’ll touch them constantly.
• Fluent in L2/L3 fundamentals: VLANs, STP family, LACP, OSPF/IS-IS, VRFs, NAT, VPNs, QoS.
• Comfortable driving troubleshooting with tcpdump, Wireshark, iperf, MTR, and packet captures on both ends of a session.
• Comfortable in front of a customer. You can sit on a call with a partner’s engineering team, read their network, explain what needs to change, and do it without condescension. This role is technical but not back-office.
• Based in Kenya, or ready to be. You’ll be close to our facilities in Mombasa and Nairobi and on calls with partners in the same time zone. NICE-TO-HAVE
• Experience running or contributing to SONiC, FRR, or other open-source networking stacks.
• Automation chops — Python, Go, or Bash — especially against NETCONF/gNMI, Nautobot, or Jinja-driven config pipelines.
• IPv6 planning and dual-stack rollout experience at subscriber scale.
• Exposure to Internet Exchange operations, looking-glass and route-server behaviour, and IRR/RPKI hygiene.
• Working familiarity with FreeRADIUS, CoA/Disconnect flows, and RADIUS-driven billing integrations — enough to debug jointly with the Systems team, not to own the stack.
• Any PtP/PtMP wireless background is a plus for partner conversations, but it isn’t the job — we are not a WISP. WHAT WE OFFER
• A seat at the table while we build the technical backbone of Africa’s next-generation internet — the decisions you make here will be visible in how entire ISP partners run their networks.
• Competitive salary and meaningful equity in a mission-driven, investor-backed company (US-incorporated; Kenya operating entity).
• Private health and wellness benefits — we’ll walk through these during the process.
• A high-ownership environment with a steep but well-supported learning curve, and a team that writes things down.

laptop-ats-crawler v2