This note is not a retainer pitch. It is the arithmetic we do when someone sends us a job description and asks whether they should post it. Sometimes the answer is yes, post it, and do not call us. That has to be a possible ending; if it is not, the rest of this is an advertorial.
The posting you are writing probably asks for Kubernetes, Terraform, AWS, CI/CD, on-call, security and “a platform mindset”. That is not a profile. It is three needs stapled together, and the stapling is the mistake. The Spanish title says DevOps because that is how people search; the work, if the posting is honest, is platform.
Three needs, one posting
Before you budget a person, name the work. All three disguise themselves as the same posting. Only one of them wants an indefinite contract.
| Need | Shape | Right answer |
|---|---|---|
| Build it once | End date, one outcome: the first real path to production, Terraform around the snowflake, out of the console. | A boutique or a fixed-term contract. Not a permanent hire for a four-month project. |
| Operate it forever | No end date. Deploys, certificates, the rota, the Tuesday that is not an incident until it is. Needs a named owner. | A hire, with peers. A single senior on payroll recreates the problem you already have. |
| Survive a burst | A deadline you cannot move. NIS2 in ninety days, a launch, a resignation. Five crafts, six weeks each. | A boutique now; decide the payroll when the burst ends, not in this week’s posting. |
If the posting mixes all three — and most of them do — you are buying the person who looks like they can cover the burst, on the salary of operate-it-forever, for a job that ends this quarter. That person gets bored, or becomes the only one who knows, or both.
The loaded cost of a hire
The number that goes into the budget is gross salary. The number that leaves the account in year one does not look like it. It has to be put in full, because it is the one nobody writes on the sheet: gross, employer social security, recruiting fee, laptop and tooling seats, and three to six months until the first change that matters.
Gross bands are from the Manfred Salary Guide 2026 for SRE/DevOps by experience, published January 2026 on more than 120,000 profiles. We do not average them with Glassdoor (~€42,600 mean in the wide market, consultancies included): those are two markets under the same job title. If you are posting for a product company, use Manfred. If you post a consultancy salary for product work, you hire someone who cannot do it, and then you call a boutique anyway.
| Level (Manfred 2026) | Experience | Gross / year |
|---|---|---|
| Mid | 2–5 years | €36,000 – €45,000 |
| Senior | 5–10 years | €46,000 – €60,000 |
| Lead / principal | >10 years | €61,000 – €80,000 |
Manfred puts the SRE/DevOps block median at €58,500. The posting you are drafting, if it asks for real autonomy over production, is not the mid. Three working numbers inside those bands: €45,000 (the “senior” budgeted as a mid), €55,000 (the senior you actually need), €70,000 (a lead, or the senior who can evaluate the next hire).
Employer social security, indefinite contract, is 23.60% common contingencies, 5.50% unemployment, 0.20% FOGASA, 0.60% training, 0.75% MEI, plus AT/EP. For CNAE 62 (programming and consultancy) AT/EP is 1.50%. Total: 32.15% of the contribution base, per Orden PJC/297/2026 and the premium tariff. The 2026 monthly cap is €5,101.20, so a €70,000 gross does not pay 32% of €70,000. The solidarity contribution on the excess, at these salaries, is noise: about €90 a year on the €70,000 row. Your CNAE may move AT/EP by a few tenths of a point; that is hundreds of euros, not tens of thousands.
Recruiting: 15–25% of first-year gross is the agency range on Spanish IT searches. We use 20%. If you already have inbound and you do not pay an agency, drop that row; do not pretend the rest vanishes with it. Laptop, peripherals and seats (GitHub, Slack, 1Password, IDE, MDM): €4,000 in year one, a round number. That line does not change the decision.
| Year-one line | Mid €45,000 | Senior €55,000 | Lead €70,000 |
|---|---|---|---|
| Gross salary | €45,000 | €55,000 | €70,000 |
| Employer SS (base cap €5,101.20/mo) | €14,500 | €17,700 | €19,800 |
| Recruiting (20%) | €9,000 | €11,000 | €14,000 |
| Laptop and seats | €4,000 | €4,000 | €4,000 |
| First-year loaded | €72,500 | €87,700 | €107,800 |
| Year 2 (no agency, €1,500 seats) | €61,000 | €74,200 | €91,300 |
The loaded first year is 1.5–1.6× gross. That is the number that should be in the budget, and it almost never is. On top: two to four months to an accepted offer, plus notice, plus three to six months to the first change that matters. From posting to production noticing, the real calendar is half a year and up. Salary runs the whole time.
The loaded cost of a boutique
Honesty has to run the other way too. A boutique day costs more than a payroll day. Context is billed. And if you never take the work back, you have rented a more expensive bus factor of one.
A senior DevOps freelancer in Spain is advertised, in 2026, at €550–750/day; Malt’s barometer sits around a €574 mean. That is one person. A boutique with a team behind them — cover, review, somebody who is not the only one who knows — sits higher: we use €700–1,100/day as the range, and €850 as the working number. It is not our rate; it is the middle of the market this note compares against. The Big Four charge more, and you are buying a brand and a junior with a slide.
We count 18 billed days in a month, not 20: public holidays and the days that are not delivery exist for the vendor too. Context ramp is one or two weeks, and it is billed. That is not a discount. It is the price of that person not having been in last year’s stand-ups.
| Rate × 18 days/month | 3 months | 6 months | 12 months |
|---|---|---|---|
| €700/day | €37,800 | €75,600 | €151,200 |
| €850/day (working number) | €45,900 | €91,800 | €183,600 |
| €1,100/day | €59,400 | €118,800 | €237,600 |
At twelve months the boutique is more expensive in cash, and it is not close. At three, it is cheaper, and you have bought months of delivery instead of months of onboarding. The risk that does not fit in the table: if the contract has no end date and no internal owner, the vendor becomes load-bearing. We charge more. We do not have a thirty-day notice period with you. That is not an operations model. It is a mortgage with a commercial counterpart.
When a hire becomes cheaper
The crossover, on working numbers: a senior at €55,000 (€87,700 in year one), a boutique at €850/day × 18 days (€15,300 a month). The hire ramps for four months and you pay anyway. The boutique ramps for two weeks and those weeks are billed. You cannot “unhire” year one of an indefinite contract because the project was a quarter: the fee already left, the laptop is on a desk, HR already ran the contract.
| The work lasts | Cash, hire | Cash, boutique | Cheaper |
|---|---|---|---|
| 3 months | €87,700 | €45,900 | Boutique, and it is not close |
| 6 months | €87,700 | €91,800 | A toss-up on cash. On delivery, boutique: five and a half productive months against two. |
| 9 months | €87,700 | €137,700 | Hire, on cash |
| 12 months | €87,700 | €183,600 | Hire |
| Year 2 of operations | €74,200 | €183,600 | Hire, and it is not close |
Ignoring ramp, the senior cash crossover is at 5.7 months. A lead at €70,000 crosses at 7.0. A mid at €45,000 at 4.7 — and then you discover the mid could not do the posting you wrote. The crossover is not a chart. It is that table, and the question of whether the work has an end date.
Bus factor of one is not a staffing model
A single hire recreates exactly the problem in your only DevOps engineer just resigned. You have spent the loaded first year putting the whole system back in one head. That person’s notice period, when it comes, is once again the last time that knowledge is free.
If the platform team is one person, you are not hiring a peer. You are hiring a successor in advance, and hoping they stay. That is not a model. It is a calendar. Two people who can deploy, rotate a key and restore a backup is not a large-company luxury: it is the floor at which “operate it forever” stops being a euphemism for “pray”.
A boutique does not fix bus factor by existing. If eighteen months later you still cannot deploy without us, we failed. If you structured the contract so you never had to look, you failed. Both happen, and both show up on the month-19 invoice.
When hiring clearly wins
The arithmetic does not need twisting. There are cases where the posting goes up, and we should not be in the thread.
- Steady-state operations: the path to production already exists, the rota already turns, the next two years of work are Tuesdays. Year 2 in the table above is not a projection. It is the budget.
- Deep product coupling: whoever runs the platform has to sit in the service design, not in a vendor Slack channel. If every user story touches a cloud resource, that person is on the product team under another title.
- Compliance that requires a named internal owner: NIS2, ISO, a customer who audits, a board that wants a counterpart on payroll. A vendor can build the evidence. They cannot be the accountable person the auditor will call.
- A team already big enough that the hire has peers. Second or third platform hire, with a real rota and somebody who can review a Terraform plan at six. Then the indefinite contract stops being a bus factor. It starts being a department.
If you are in one of those four, post it. Do not use us to delay a posting you should already have put up.
When outsourcing clearly wins
- A defined build with an end date. “Leave one path to production and Terraform somebody else can pick up” is a project. “A DevOps person” is not.
- A deadline you cannot move. The launch is in nine weeks. NIS2 will not wait for the recruiter to close the loop. The leaver finishes on Friday. The hire you have not interviewed yet will not arrive in time, and pretending otherwise is how panic offers get signed.
- Five skill sets for six weeks each: Kubernetes, the network, CI, the IdP, observability. The candidate who is senior in all five and free next month does not exist. A small team that splits them, and then leaves, does.
- Nobody senior enough internally to evaluate the hire you are about to make. If the posting is being written by a CTO who has not touched a cluster in three years, or an office manager with an InfoJobs template, you are going to hire confidence, not judgement. A hiring process that cannot reject somebody should not be posted.
The hybrid that usually wins
The shape we see work most often is not in the posting. It is more boring: outsource the build, hire for the operate, and overlap them on purpose for one month.
The boutique leaves a path, not a hero. The new hire arrives at something that already deploys, not at a wiki and a console. The overlap month is not “shadowing as a courtesy”. It is a handover: the person who stays types, the person who leaves talks, and by the end of the month there are proofs — a deploy, a key rotation, a restore — done by whoever stays. If by Friday of week four that has not happened, you did not overlap. You paid an extra month of context that walked down the hall.
The overlap month is a handover with a pass or a fail, not a wiki. The long version is in the handover: a day we are unreachable, you ship and roll back. A vendor-to-payroll handover that is not executed is theatre with a higher invoice.
The calendar, roughly: two or three months of external build, the posting goes up in month 1 — not when the build ends —, the hire starts in month 3 or 4, one month of overlap, the boutique leaves. You pay one month twice on purpose. It is the cheapest month of the year, because it is the one that avoids year 2 in which the new hire rediscovers the system blind.
Where this breaks in practice
- Posting the job to “see how it goes” and using the boutique as a crutch while the process never closes. At month nine you have both invoices and no decision.
- Hiring the mid because the senior “does not fit the band”. The mid cannot evaluate the posting, cannot hold the rota alone, and at six months you are here again, with less time and the same cluster.
- Asking the boutique to “train whoever joins” with no overlap month in the contract. Training is not a deliverable you leave in Confluence. It is a month in which both sides are paid and one of them types.
- Treating the 5.7-month crossover as a forecast. It is arithmetic with assumptions. If your ramp is eight months, the boutique wins for longer. If you already have inbound and you do not pay an agency, the hire wins sooner. Substitute the numbers. Do not substitute the question.
Do not hire us if
The list is explicit. If you are on it, the email is surplus. Post the job, or do nothing; do not put us in the middle.
- You have one service and no traffic. A senior platform engineer is idle. A backend can copy a GitHub Action. The posting you are drafting is a fantasy of scale.
- You want somebody on call for €2,000 a month. That is not a person and it is not us. Night cover for a single engineer is either unpaid, or it is a team, or it is a lie. A boutique retainer at that price is the same lie with VAT.
- You want to hand over a problem and never look at it again. We will not hold a pager you refuse to understand. Month 18, when the contract is up for renewal, you discover the system is still in one head. This time the head issues invoices.
- You are hoping a vendor will win an internal argument for you. A report that says “you should do Kubernetes” does not survive contact with a sceptical CTO. If the decision is not yours to make, do not buy a consultant to launder it.
If you already have two platform people and a real on-call rota, hire the third. Do not call us to be the third. If the work is operate-it-forever and the team already exists, the posting is the right decision, and this note is finished for you.
Send us the job description you were about to post. We will tell you whether we would take the work, and what we would do instead. Sometimes the answer is: post it, and do not call us. hola@pikas.systems