Principal Platform Engineer

<p>This is a hands-on engineering and technical leadership position. You will move fluidly between  building production infrastructure, architecting multi-tenant isolation, designing pipeline and policy enforcement, leading strategic architecture decisions, and mentoring engineers. Your success is measured by what every product inherits: a compounding system that outlasts your direct involvement.</p>

<p> </p>

<p><strong>What You'll Do</strong></p>

<p><strong>Platform Architecture & Infrastructure Engineering</strong></p>

<ul>

<li>Drive the platform's architecture and runtime direction, including convergence onto one container-orchestrated runtime, tenancy-grade isolation between client engagements, and the contracts every product inherits.</li>

<li>Design composable infrastructure as code at fleet scale, with clear input contracts and state boundaries, published as versioned templates and images for every core component.</li>

<li>Make the environment lifecycle a one-command operation: created by merging a pull request, destroyed by deleting it, with automated proof nothing is left behind.</li>

<li>Design identity and network as a federated, credential-free system — one identity per engagement, just-in-time audited privileged access, separate internal and external edges.</li>

<li>Ship telemetry and cost visibility out of the box for every service: standard alerting, service-level objectives on live data, fault injection, and per-engagement cost attribution including AI spend.</li>

</ul>

<p> </p>

<p><strong>Delivery Pipelines, Security & Compliance Engineering</strong></p>

<ul>

<li>Drive the shared delivery pipelines every product runs through, and the pluggable gate framework that quality, security, and AI-governance checks plug into with block-on-fail enforcement.</li>

<li>Implement security and compliance as code: release-blocking scanning on every repository, policy and admission control, signed and attested artifacts, and an audit trail and software bill of materials, including AI components, on every build as SOC2 / ISO 27001 evidence.</li>

<li>Package the AI-assisted development environment as a versioned, first-class deliverable, and enforce the sandbox boundary for coding agents: default-deny egress, short-lived credentials, isolated shared runners.</li>

<li>Run the platform as a product measured by developer outcomes — setup time, time to first commit, pipeline duration, gate false-positive rate, adoption — pruning or redesigning controls when governance burden outgrows benefit, and proving every golden path by shipping through it yourself.</li>

</ul>

<p> </p>

<p><strong>Technical Leadership & Stakeholder Influence</strong></p>

<ul>

<li>Lead the platform's strategic architecture decisions — multi-tenancy, cloud posture, identity provider, network edge — as evidence-based decision documents with real trade-offs, and own the security and reliability evidence the program reports against.</li>

<li>Serve as a go-to technical authority on platform architecture and delivery engineering, consulted by senior stakeholders at the design and strategy stages, translating trade-offs and platform risk into actionable guidance, and mentoring engineers and vendor partners with observable improvement in design quality and production readiness.</li>

</ul>

<p> </p>

<p><strong>What You'll Need</strong></p>

<p><strong>Required</strong></p>

<ul>

<li>15+ years in software engineering, platform or infrastructure engineering, or a closely related technical field.</li>

<li>Deep, hands-on expertise in infrastructure as code at fleet scale (Terraform or OpenTofu with Terragrunt or equivalent): module architecture, remote state, multi-environment topology.</li>

<li>Demonstrated experience operating multi-tenant Kubernetes platforms in production: GitOps, network and admission policy, workload identity, tenant isolation.</li>

<li>Proven track record building CI/CD as a shared platform (GitHub Actions or equivalent), with reusable workflow contracts, fleet-scale branch protection, and enforced quality and security gates.</li>

<li>Strong hands-on command of cloud identity and network security on Azure/AWS/GCP or a comparable hyperscaler: workload identity federation, RBAC, private networking, WAF, DNS.</li>

<li>Substantive experience with security and compliance as code: scanning toolchains (Snyk, Checkov, Trivy), policy engines (OPA, Kyverno, Azure Policy), supply chain controls (signing, provenance, SBOM), and SOC2 / ISO 27001 control evidence.</li>

<li>Production observability with OpenTelemetry or equivalent: collector topology, SLOs and error budgets, alert routing, incident management, fault injection.</li>

<li>Has built and operated production application software as a software engineer, in at least one of Go, Python, or TypeScript, and is fluent in testing strategy, code review, trunk-based delivery, and release management.</li>

<li>Excellent written and verbal communication skills in English; ability to translate complex technical topics to diverse audiences, including executive stakeholders.</li>

<li>Experience with Agile methodologies and cross-functional product team collaboration.</li>

</ul>

<p> </p>

<p>Preferred / Additional Qualifications</p>

<ul>

<li>Experience building platforms for consulting, advisory, or professional services, including client-isolation and data-residency requirements.</li>

<li>Familiarity with virtual-cluster and control-plane tooling (vcluster, Crossplane) and developer portals (Backstage, Port).</li>

<li>Experience operating a platform used by AI coding assistants (Claude Code, GitHub Copilot or similar), including sandboxing of agent tooling.</li>

<li>Advanced certifications in cloud architecture, Kubernetes, or security (e.g., Azure Solutions Architect, CKA/CKS, CISSP).</li>

<li>FinOps experience: cost allocation, showback, and cloud cost optimization.</li>

<li>Demonstrated enthusiasm for developer education — writing internal guides, running workshops, or building internal tooling communities.</li>

</ul>