Principal Platform Engineer

Ocho; United Kingdom; Remote; GBP 80,000 - 90,000; Full time

Benefits offered by this job

Fully remote work

Generous annual leave

Comprehensive benefits package

Principal-level influence

Job summary

Ocho is seeking a Principal Platform Engineer to design and run the secure hosting core that every product in our fintech runs on. This hands-on role reports to the Director of Platform Engineering and combines system design with production code in Go, C#, Java or Rust across on-premises, private cloud, OCI, AWS and Azure.

You’ll lead architecture decisions, mentor engineers, drive reliability through SLOs and audits, and collaborate across Systems, Network, DevOps and InfoSec.

Qualifications

• Extensive experience designing, building and running production infrastructure platforms.
• Strong knowledge of at least one statically typed backend language.
• Hybrid and multi-cloud design experience with failover strategies.
• Deep PKI, CA design, rotation, and mTLS at scale.
• Identity management knowledge incl. Entra ID, OAuth 2.0, OIDC, SAML.
• Secrets management and zero-trust networking.
• SRE practices: SLOs, telemetry, incident management.

Responsibilities

• Design the secure hosting core across on-premises, private cloud, OCI, AWS and Azure, and own the architecture decisions behind it
• Lead the move from Active Directory to Entra ID, and build an internal identity platform for just-in-time and privileged access with PCI DSS and SOX audit evidence
• Design and run the certificate authority on HashiCorp Vault, with mTLS between services and automated issuance and rotation
• Keep every secret in Vault with automatic rotation, secret scanning across the estate and 72-hour rotation of any credential
• Design and run external and internal DNS, including DNSSEC and zone migrations, with all origins locked down behind Cloudflare
• Build desired-state control planes that drive DNS, load balancers, firewalls, service discovery and cloud through their APIs, with drift detection
• Shift network and egress control to policy as code, leading zero trust network access and identity-based segmentation
• Build policy-as-code decision services and supply-chain controls, including signed artefacts, admission control and vulnerability gating
• Run the platform to SLOs and error budgets, owning telemetry, alerting, capacity planning, safe releases and tested, immutable recovery
• Lead design reviews, blameless incident reviews and on-call escalation, and mentor senior engineers

Skills

Go

C#

Java

Rust

Production code daily

System design

Tools

HashiCorp Vault

Terraform

Cloudflare

Entra ID

Certificate Authority

DNS management

OCI/AWS/Azure

Job description

Principal Platform Engineer ( Fully remote) Multiple hires

At-a-Glance

• Principal-level, hands-on platform engineering role reporting to the Director of Platform Engineering
• Tech: Go, C#, Java or Rust, HashiCorp Vault, Cloudflare, Entra ID, Terraform, OCI, AWS and Azure
• Fully remote, UK or Ireland
• Competitive salary plus bonus
• Design and code the secure hosting platform every product in a global fintech runs on

About the Company

Our client is a fast-growing global fintech business whose technology helps businesses of all sizes get paid and grow. It operates at scale across multiple regions, in a highly regulated environment where security and reliability are non-negotiable. Engineering teams move quickly and are embracing AI-assisted development, and the platform they build on is seen as a genuine competitive advantage.

The Role

Platform Engineering builds and runs the secure hosting core that every product ships onto... effectively a private cloud spanning data centres, private cloud and public cloud, covering runtime, network, identity, secrets, edge, observability and recovery. As Principal Platform Engineer you design that platform and write the software that runs it. You'll think in systems, removing whole classes of security and reliability problems rather than fixing each instance, and turning every control into a measurable service level objective. You'll work across Systems, Network, DevOps, Reliability and Information Security engineers, set the technical standards others build on, lead during major incidents and mentor senior engineers. It suits someone who still writes production code every day and uses AI agents as part of how they work.

Key Responsibilities

• Design the secure hosting core across on-premises, private cloud, OCI, AWS and Azure, and own the architecture decisions behind it
• Lead the move from Active Directory to Entra ID, and build an internal identity platform for just-in-time and privileged access with PCI DSS and SOX audit evidence
• Design and run the certificate authority on HashiCorp Vault, with mTLS between services and automated issuance and rotation
• Keep every secret in Vault with automatic rotation, secret scanning across the estate and 72-hour rotation of any credential
• Design and run external and internal DNS, including DNSSEC and zone migrations, with all origins locked down behind Cloudflare
• Build desired-state control planes that drive DNS, load balancers, firewalls, service discovery and cloud through their APIs, with drift detection
• Shift network and egress control to policy as code, leading zero trust network access and identity-based segmentation
• Build policy-as-code decision services and supply-chain controls, including signed artefacts, admission control and vulnerability gating
• Run the platform to SLOs and error budgets, owning telemetry, alerting, capacity planning, safe releases and tested, immutable recovery
• Lead design reviews, blameless incident reviews and on-call escalation, and mentor senior engineers

What You'll Need

• Substantial experience as a senior or lead engineer designing, building and running production infrastructure platforms
• Expert in at least one statically typed backend language (C#, Java, Go or Rust), writing production code daily
• Hybrid and multi-cloud design across on-premises, private and public cloud, and how it fails
• Deep PKI and certificate authority experience, including CA hierarchy design, rotation and mTLS at scale
• Strong identity knowledge: Active Directory internals, Entra ID, OAuth 2.0, OIDC, SAML and privileged access
• Secrets management, workload identity and encryption in transit and at rest
• DNS (including DNSSEC and split horizon) and network security: TLS, firewalls, egress control, segmentation and zero trust
• SRE practice: SLOs, error budgets, telemetry, incident command and rolling, blue-green and canary releases with automated rollback
• Experience building control planes with reconciliation and drift detection, plus clear technical writing (RFCs, API specs, post-incident reviews)
• Based in the UK with the right to work here

Desirable / Nice to Have:

• Cloudflare, HashiCorp Vault and Terraform (including custom providers), all managed as code
• Policy as code with OPA/Rego or Sentinel, and supply-chain security such as artefact signing and admission control
• AI-assisted engineering with Claude Code, Codex or Cursor, and building or reviewing tightly scoped MCP servers

Why Apply?

• Competitive salary 80-90k base + bonus
• Fully remote, UK/Ireland based
• Generous annual leave
• Comprehensive benefits package, details on request
• Principal-level influence: you set the standards the whole engineering organisation builds on
• A genuinely hands-on role, still writing code daily rather than drifting into management
• Shape how people and AI agents use the platform safely at scale