VP of Systems Engineer
- Role
- Engineering Management
- Experience
- Lead
- Employment
- Full-time
- Company size
- Startup
Open to 7 countries. Set where you work from to check your eligibility.
No BS summary
Hands-on VP/lead systems engineer with 8+ years in systems or network engineering and end-to-end RADIUS/network-authentication ownership in an ISP or telecom environment. Must know FreeRADIUS deeply, Linux administration, PPPoE/DHCP/IP pools/BNG-RADIUS behavior, production infrastructure, scripting, SQL, and Hono/Express-style API work. Hiring is limited to South Africa, Poland, France, United Kingdom, Spain, Germany, and Netherlands.
Core skills
Required skills
Optional skills
About Share
Share is a venture-backed internet infrastructure network building Africa's backbone. The company aggregates underutilized telecom infrastructure, fiber, subsea cables, and data centers, and provides ISPs with scalable access to bandwidth without traditional upfront costs. Share's network spans thousands of kilometers of fiber, 12 infrastructure providers, and 10 data centers, reaching over 8 million people across East Africa.
At the network level, Share operates a RADIUS proxy architecture that authenticates ISP subscribers, provisions their internet access, and coordinates with partner BNG (Broadband Network Gateway) equipment. The platform must coexist with existing ISP infrastructure, not replace it. This means every deployment involves real BNG configuration, real RADIUS authentication, and real subscriber traffic.
This role sits at the intersection of network engineering and systems engineering. You will own Share's systems function end to end — the infrastructure that makes internet access work for our partner ISPs, and the team you'll build to run it as we scale.
The role
We are hiring a VP of Systems Engineering to build, own and lead Share's network-facing infrastructure: the FreeRADIUS proxy servers that authenticate ISP subscribers, the provisioning pipeline that pushes credentials and plan attributes to per-partner RADIUS servers, the BNG integration layer, and the deployment and monitoring of all systems infrastructure. You will work directly with the network team (who handle ISP-side BNG configuration) and the software team (who build the APIs that drive provisioning).
This is a player-coach role. You are hands-on today; you will configure FreeRADIUS servers, write deployment scripts, troubleshoot authentication failures on production networks, and design the infrastructure that scales from 10 ISP clients to 500. And as Share grows, you will hire and lead the systems engineering team, set the technical standard they work to, and own the roadmap for how our infrastructure is built and run. You are the person the team calls when a subscriber can't authenticate or when a new ISP's BNG doesn't behave as expected — and the person who decides how we solve it at scale.
What you will own
- FreeRADIUS proxy architecture: Share operates a central RADIUS proxy that routes authentication requests to per-partner FreeRADIUS servers. The proxy uses a failover mechanism (soft reject → attribute clearing → failover to partner pool) to determine whether a subscriber is Share-managed or partner-managed. You will own the configuration, deployment, monitoring, and scaling of this architecture.
- Per-partner FreeRADIUS servers: Each ISP partner gets a dedicated FreeRADIUS instance with a Hono API overlay for programmatic CRUD of subscriber credentials and plan attributes. You will manage these instances, their database backends, and their API endpoints.
- BNG integration support: Work with the network team to define and validate the BNG-side configuration changes required for each ISP partner (RADIUS pointer, Share-specific subnet, source-based routing, pool configuration). You are the bridge between the software platform and the ISP's physical infrastructure.
- Provisioning pipeline: The software platform's Provisioning service pushes subscriber credentials and plan attributes to FreeRADIUS. You own the receiving end — ensuring the FreeRADIUS API, database, and RADIUS configuration are correct and performant.
- Infrastructure and deployment: Server provisioning, deployment automation, monitoring, logging, and security for all systems infrastructure. GitHub Actions pipelines, SSH-based deployments, VM management.
- CoA (Change of Authorization): Design and implement the CoA endpoint on per-partner FreeRADIUS servers for real-time plan changes and session disconnects without re-authentication.
- Team and technical leadership: Set the standards, runbooks, and architecture for Share's systems function. Hire, mentor, and lead the systems engineering team as we scale, and represent systems engineering in technical and cross-functional decisions.
Technical environment
RADIUS and network authentication
- FreeRADIUS (v3 in production, v4 evaluation in progress) — proxy configuration, virtual servers, module configuration (sql, rest, files)
- RADIUS protocols: Access-Request/Accept/Reject, Accounting (Start/Interim/Stop), CoA (Disconnect-Request, CoA-Request)
- PPPoE authentication flow: subscriber CPE → BNG → RADIUS proxy → per-partner RADIUS → response with speed/pool/timeout attributes
- MikroTik RouterOS BNG configuration (the network team handles this, but you need to understand the RADIUS-facing side)
- Per-user flat attributes (speed, IP pool, session timeout) pushed via Hono API to FreeRADIUS SQL backend
Systems and infrastructure
- Linux server administration (Ubuntu)
- Docker containerization for FreeRADIUS instances and supporting services
- Hono (lightweight Node.js framework) for the FreeRADIUS API overlay
- PostgreSQL for RADIUS user databases (radcheck, radreply, radacct tables)
- GitHub Actions for CI/CD, SSH-based deployment to VMs
- Monitoring: Loki + Pino for structured logging, Sentry for error tracking
Integration points with the software platform
- NestJS Provisioning microservice calls your FreeRADIUS API to push/update/delete subscriber credentials
- Kafka events trigger provisioning actions (PROVISION_SUBSCRIBER, UPDATE_PLAN_ATTRIBUTES, DELETE_RADIUS_CREDENTIALS)
- The proxy's routing decision (Share vs partner) determines the subscriber's billing path
Requirements
Non-negotiable
- 8+ years of professional systems engineering or network engineering experience, including having owned the RADIUS/network-authentication function end to end in a production ISP or telecommunications environment (FreeRADIUS, Radiator, or NPS), and having led or mentored other engineers.
- Deep FreeRADIUS expertise. You can configure virtual servers, write unlang policies, set up proxy realms, configure SQL modules, and debug authentication failures from packet captures.
- Strong Linux systems administration. You manage production servers, write deployment scripts, configure firewalls, and troubleshoot networking issues at the OS level.
- Understanding of PPPoE authentication, DHCP, IP pool management, and how BNGs interact with RADIUS servers. You don't need to be a MikroTik expert, but you need to understand what the BNG expects from RADIUS.
- Experience deploying and managing infrastructure in production — not just dev environments. You understand uptime requirements, failover, and what happens when a RADIUS server goes down (subscribers can't authenticate).
- Comfortable with scripting and light application development. You don't need to be a full-stack developer, but you should be able to write and maintain a Hono/Express API, work with SQL databases, and automate deployments.
Preference
- Experience in East African ISP or telecommunications infrastructure. Understanding of the operational realities: MikroTik-dominant networks, mixed vendor environments, bandwidth constraints, and the practical challenges of managing subscriber authentication at scale in this market.
- Experience with FreeRADIUS proxy configurations (proxying between multiple RADIUS servers with failover logic).
- Experience with CoA (Change of Authorization) and Disconnect-Message implementation.
- Docker and container orchestration for networking services.
- Experience working alongside software engineering teams — you can read a NestJS service, understand an event-driven architecture diagram, and communicate technical constraints clearly to developers.
AI-augmented engineering (required mindset)
Share operates with AI tools as a core part of engineering workflows. This applies to systems engineering as much as software development. Our infrastructure documentation, configuration templates, troubleshooting runbooks, and deployment scripts are all developed with AI assistance.
What this means for you:
- You use AI tools (LLMs, Agents, etc.) for configuration generation, troubleshooting, documentation, and scripting. You don't memorize FreeRADIUS syntax but rather know what you need and use AI to get there faster.
- You are comfortable with AI-generated specifications and can validate them against real-world behavior. When a spec says "configure source-based routing on the BNG," you know whether that's correct for MikroTik and can flag when it's not.
- You see AI as a way to handle the breadth of systems knowledge required for this role (RADIUS, Linux, networking, databases, deployment, monitoring).
- You contribute to the team's AI workflows by writing clear, structured documentation that both humans and AI can work with.
What we offer
- Competitive salary and meaningful equity in a mission-driven, investor-backed company (US-incorporated).
- A seat at the table while we build the technical backbone for the next-generation of telecommunications.
- A fast-paced, high-ownership environment.
What you'll do
- Build, own, and lead Share's network-facing infrastructure.
- Own the FreeRADIUS proxy servers that authenticate ISP subscribers.
- Own the provisioning pipeline that pushes credentials and plan attributes to per-partner RADIUS servers.
- Own the BNG integration layer.
- Own deployment and monitoring of all systems infrastructure.
- Work directly with the network team handling ISP-side BNG configuration.
- Work directly with the software team building the APIs that drive provisioning.
- Configure FreeRADIUS servers.
- Write deployment scripts.
- Troubleshoot authentication failures on production networks.
- Design infrastructure that scales from 10 ISP clients to 500.
- Hire and lead the systems engineering team as Share grows.
- Set the technical standard for the systems engineering team.
- Own the roadmap for how infrastructure is built and run.
- Decide how to solve subscriber authentication and BNG behavior issues at scale.
- Own the configuration, deployment, monitoring, and scaling of the central RADIUS proxy architecture.
- Manage dedicated per-partner FreeRADIUS instances with a Hono API overlay.
- Manage per-partner FreeRADIUS database backends and API endpoints.
- Work with the network team to define and validate BNG-side configuration changes required for each ISP partner, including RADIUS pointer, Share-specific subnet, source-based routing, and pool configuration.
- Bridge the software platform and the ISP's physical infrastructure.
- Ensure the FreeRADIUS API, database, and RADIUS configuration are correct and performant for the provisioning pipeline.
- Handle server provisioning, deployment automation, monitoring, logging, and security for all systems infrastructure.
- Manage GitHub Actions pipelines, SSH-based deployments, and VM management.
- Design and implement the CoA endpoint on per-partner FreeRADIUS servers for real-time plan changes and session disconnects without re-authentication.
- Set standards, runbooks, and architecture for Share's systems function.
- Hire, mentor, and lead the systems engineering team as Share scales.
- Represent systems engineering in technical and cross-functional decisions.
- Use AI tools for configuration generation, troubleshooting, documentation, and scripting.
- Validate AI-generated specifications against real-world behavior.
- Contribute to the team's AI workflows by writing clear, structured documentation that both humans and AI can work with.
What they require
- 8+ years of professional systems engineering or network engineering experience.
- Owned the RADIUS/network-authentication function end to end in a production ISP or telecommunications environment using FreeRADIUS, Radiator, or NPS.
- Led or mentored other engineers.
- Deep FreeRADIUS expertise, including configuring virtual servers, writing unlang policies, setting up proxy realms, configuring SQL modules, and debugging authentication failures from packet captures.
- Strong Linux systems administration, including managing production servers, writing deployment scripts, configuring firewalls, and troubleshooting networking issues at the OS level.
- Understanding of PPPoE authentication, DHCP, IP pool management, and how BNGs interact with RADIUS servers.
- Understand what the BNG expects from RADIUS; MikroTik expertise is not required.
- Experience deploying and managing infrastructure in production, not just dev environments.
- Understand uptime requirements, failover, and what happens when a RADIUS server goes down.
- Comfortable with scripting and light application development.
- Able to write and maintain a Hono/Express API, work with SQL databases, and automate deployments.
- Required mindset: uses AI tools as a core part of engineering workflows.
- Comfortable with AI-generated specifications and able to validate them against real-world behavior.
- Able to judge whether AI-generated networking specifications are correct for MikroTik and flag issues.
- Sees AI as a way to handle broad systems knowledge across RADIUS, Linux, networking, databases, deployment, and monitoring.
- Preferred: Experience in East African ISP or telecommunications infrastructure.
- Preferred: Understanding of operational realities in East African ISP infrastructure, including MikroTik-dominant networks, mixed vendor environments, bandwidth constraints, and practical challenges of managing subscriber authentication at scale in this market.
- Preferred: Experience working alongside software engineering teams and communicating technical constraints clearly to developers.
Benefits
- Competitive salary.
- Meaningful equity in a mission-driven, investor-backed company.
- A seat at the table while building the technical backbone for the next generation of telecommunications.
- Fast-paced, high-ownership environment.
Share is a venture-backed internet infrastructure network building Africa's backbone. The company aggregates underutilized telecom infrastructure, fiber, subsea cables, and data centers, and provides ISPs with scalable access to bandwidth without traditional upfront costs.