Senior Platform/DevOps Architect

XPT Software; Sydney; On-site; AUD 180,000 - 260,000; Full time

Job summary

XPT Software is seeking a Technical Owner to design and build the GitHub Enterprise Cloud landing zone and the golden-path reusable workflow library that every migrated repository consumes — the standardisation layer the migration lands on.

You will drive enterprise CI/CD architecture, integrate GHAS and other security tooling, and coordinate with security teams to prepare a smooth handover to client BAU.

Qualifications

• 12+ years platform/DevOps engineering experience.
• 4+ years deep GitHub Actions experience (reusable workflows, self-hosted runners at scale).
• Expert Jenkins internals: declarative and scripted pipelines, shared libraries, multibranch.
• Enterprise CI/CD architecture: promotion models, environment strategy, secrets management, policy-as-code.
• GHAS or equivalent AppSec tooling integration; IaC (Terraform) for platform provisioning.
• Strong written design skills with ADRs and runbooks.

Responsibilities

• Design the GHEC foundation: org/repo topology, SSO/SCIM identity integration, Rulesets, branch protection, CODEOWNERS strategy, and marketplace/actions allowlist governance.
• Author and version the golden-path reusable GitHub Actions workflows per archetype (Java/Maven, Node/TS, Python, container, Terraform, etc.), consumed by reference (uses: org/repo@version) — never copied — with drift detection.
• Design the self-hosted runner topology (residency-aware, Azure/AWS network routes) and integrate enterprise tooling: GHAS (secret/code scanning), Snyk/Sonar-class scanners, Vault/CyberArk, Artifactory.
• Define the Jenkins→Actions conversion standards the AI agents implement: secrets re-binding, shared-library equivalence, trigger mapping, artefact handling (including Git LFS / artefact-store strategy for large in-repo binaries).
• Act as design authority on the bespoke long-tail — the complex pipelines agents can't fully convert — and review agent-generated PRs for architectural soundness.
• Partner with client platform/security teams; prepare the platform handover to client BAU.

Skills

GitHub Actions

Self-hosted Runners

Jenkins

Bitbucket Server

CI/CD Architecture

IaC (Terraform)

AppSec tooling

Secrets Management

Runbooks/ ADRs

Tools

Terraform

Snyk

SonarQube

Vault

CyberArk

Artifactory

GitHub Enterprise Cloud

Jenkins

Job description

Role summary

Technical owner of the target platform. Designs and builds the GitHub Enterprise Cloud landing zone and the golden-path reusable workflow library that every migrated repository consumes — the standardisation layer the whole migration lands on.

Key responsibilities

• Design the GHEC foundation: org/repo topology, SSO/SCIM identity integration, Rulesets, branch protection, CODEOWNERS strategy, and marketplace/actions allowlist governance.
• Author and version the golden-path reusable GitHub Actions workflows per archetype (Java/Maven, Node/TS, Python, container, Terraform, etc.), consumed by reference (uses: org/repo@version) — never copied — with drift detection.
• Design the self-hosted runner topology (residency-aware, Azure/AWS network routes) and integrate enterprise tooling: GHAS (secret/code scanning), Snyk/Sonar-class scanners, Vault/CyberArk, Artifactory.
• Define the Jenkins→Actions conversion standards the AI agents implement: secrets re-binding, shared-library equivalence, trigger mapping, artefact handling (including Git LFS / artefact-store strategy for large in-repo binaries).
• Act as design authority on the bespoke long-tail — the complex pipelines agents can't fully convert — and review agent-generated PRs for architectural soundness.
• Partner with client platform/security teams; prepare the platform handover to client BAU.

Required skills & experience

• 12+ years platform/DevOps engineering; 4+ years deep GitHub Actions (reusable workflows, composite actions, self-hosted runners at scale).
• Expert Jenkins internals: declarative and scripted pipelines, shared libraries, multibranch, trigger graphs — and Bitbucket Server administration.
• Enterprise CI/CD architecture: promotion models, environment strategy, secrets management, policy-as-code.
• GHAS or equivalent AppSec tooling integration; IaC (Terraform) for platform provisioning.
• Strong written design skills — ADRs, standards, runbooks that survive handover.

Desirable

GEI migration experience; Kubernetes; APRA-regulated environment exposure; contribution to internal developer platforms / golden-path programmes.