Senior Cloud Platform Engineer

We run governed infrastructure across Azure, AWS, and on-prem for multiple portfolio companies. We want a Senior Cloud Platform Engineer who works as a peer on the platform. You'll work from design through production, troubleshoot hard problems without help, and raise our bar for automation, security, and documentation.

Responsibilities

Build shared Terraform modules for networking, storage, identity, compute, secrets, and monitoring with secure defaults; Version, test, and document modules so teams can upgrade without assistance; Implement policy as code (Azure Policy, conftest, SCPs and RCPs) to catch problems at plan time; Provide self-service so teams can deploy compliant environments using a short tfvars file; Deliver platform projects from design to production with the architect, including a secure platform sharing petabyte-scale data across Azure, AWS, and on-prem; Build infrastructure for teams: GPU capacity for machine learning, remote workspaces, and hybrid connectivity to the datacenter; Run proofs of concept to settle design questions and judge which new cloud features to adopt; Build and maintain landing zones and guardrails in Azure and AWS; Design and operate networking (hub-and-spoke, Transit Gateway, firewalls, private endpoints, VPC endpoints, DNS, ExpressRoute, Direct Connect, VPN); Manage identity (Entra ID, managed identities, IAM Identity Center, cross-account roles, workload identity federation); Build and maintain CI/CD for infrastructure with GitHub Actions, OIDC, self-hosted runners, and plan review in pull requests; Participate in the platform on-call rotation with the security team; Resolve escalations across identity, networking, and pipelines, and document root causes; Turn Defender for Cloud, Security Hub, GuardDuty, and Access Analyzer findings into preventive controls; Ensure monitoring and alerting for shipped systems, with an owner for every alert; Track costs for projects and right-size when needed; Write runbooks so others can operate what is built; Automate operational tasks

Requirements

5 or more years building cloud infrastructure in production; Deep experience in Azure or AWS, and solid working experience in the other; Built Terraform modules that other teams used, including versioning, testing, and releasing them; Comfortable with imports, state moves, and refactors on live infrastructure; Strong networking: routing, DNS, private connectivity, firewalls, and hybrid links (ExpressRoute or Direct Connect, and VPN); Identity and access in both clouds (Azure: Entra ID, RBAC, managed identities, private-only service design; AWS: IAM policy evaluation, SCPs, permission boundaries, cross-account trust, STS); CI/CD for infrastructure, preferably GitHub Actions with OIDC federation; Methodical troubleshooting using Activity Log, CloudTrail, flow logs, and policy simulation; Security-first habits: least privilege, no secrets in code, logging, and audit by default; Careful production habits: checking before changing or deleting, planning rollback, and documenting as you go; Has taken at least one infrastructure project from an empty repo to production; Clear writing for engineers, app teams, and leadership (design docs, runbooks, post-incident write-ups); Must be legally authorized to work in the United States without employer sponsorship, now or in the future

Nice to have

Module testing and policy tools: Terratest, conftest or OPA, tflint, Checkov or Trivy; Platform engineering: internal developer platforms, golden paths, templates, or service catalogs; AWS Control Tower and AFT (Account Factory for Terraform); Entra-to-AWS federation and single sign-on; Kubernetes on AKS or EKS: workload identity, IRSA or Pod Identity, Helm, and GitOps tools such as Argo CD or Flux; GPU or HPC infrastructure: GPU VM families, schedulers such as Slurm, or high-throughput storage; Supporting data platforms (Snowflake, Databricks, or similar) from the infrastructure side; Regulated data: ITAR or EAR, CMMC or NIST 800-171, SOC 2; Ansible, and scripting in Python, Bash, or PowerShell; Zero-trust network tools such as Zscaler (including TLS inspection) or Tailscale; Certifications: Azure Solutions Architect Expert, AWS Solutions Architect Professional, or Security Specialty

Benefits

Company-paid lunch stipend via GrubHub; 100% employer-paid medical in High Deductible Health Plan; Dental and vision benefits for employees and families; 16 weeks of paid parental leave; Employee Assistance Program; Life insurance; Short-Term Disability and Long-Term Disability; 401(k) with 100% company match up to 6%; Optional employee-paid PPO medical insurance; Health Savings Accounts with company contribution; Flexible Spending Accounts; Supplemental Life Insurance; Wellhub; 25 days of Paid Time Off plus 12 company holidays