Principal Platform Engineer (Infrastructure) - Remote
Summary
Hands-on technical leadership role building an AI-native development platform for a consulting-firm client: infrastructure as code, multi-tenant Kubernetes, secure CI/CD delivery gates, observability, and a packaged AI-assisted dev environment. Core stack includes Terraform/OpenTofu, Kubernetes/GitOps, GitHub Actions, and a major cloud (Azure/AWS/GCP).
- Set the platform’s architecture: one container-orchestrated runtime, strong isolation between client engagements, and reusable, versioned infrastructure as code that spins environments up and down on demand
- Build identity, networking, and observability in from the start, with no long-lived credentials, just-in-time audited access, SLOs and alerting, and per-engagement cost tracking (AI spend included)
- Own shared CI/CD and the gate framework behind it, so quality, security, and AI-governance checks can block releases, and compliance evidence (scanning, signed artifacts, SBOMs, SOC2/ISO 27001) comes out of every build automatically
- Package the AI-assisted dev environment as a real product with hard sandbox boundaries for coding agents, and measure the platform by developer outcomes like setup time, pipeline speed, and adoption
- Lead major architecture decisions through written trade-off docs, advise senior stakeholders on platform risk, and mentor engineers and vendor partners
- 15+ years (Principal) or 10+ years (Staff) in software, platform, or infrastructure engineering. Platform work for consulting or professional services firms, including client isolation and data residency, preferred
- Fleet-scale infrastructure as code with Terraform or OpenTofu, plus Terragrunt or similar: module design, remote state, multi-environment layouts
- Production experience running multi-tenant Kubernetes, including GitOps, network and admission policies, workload identity, and tenant isolation. vcluster or Crossplane preferred
- CI/CD built as a shared platform (GitHub Actions or similar), with reusable workflows, org-wide branch protection, and enforced gates. Developer portal experience (Backstage, Port) preferred
- Hands-on cloud identity and network security on Azure, AWS, or GCP: workload identity federation, RBAC, private networking, WAF, DNS. Certifications such as Azure Solutions Architect, CKA/CKS, or CISSP preferred
- Security and compliance automation: scanners like Snyk, Checkov, or Trivy; policy engines like OPA, Kyverno, or Azure Policy; supply chain controls (signing, provenance, SBOM); SOC2 and ISO 27001 evidence. Experience sandboxing AI coding tools (Claude Code, Copilot, etc.) preferred
- Production observability with OpenTelemetry or similar: collector design, SLOs and error budgets, alert routing, incident response, chaos testing. FinOps experience (cost allocation, showback, optimization) preferred
- Real application development experience in Go, Python, or TypeScript, plus solid habits around testing, code review, trunk-based development, and releases
- Strong written and verbal communication, including with executives. A track record of teaching through internal docs, workshops, or engineering communities preferred
- Comfort working in Agile, cross-functional product teams