Lead Infrastructure and Security Engineer

Creador; Kuala Lumpur; Presencial; MYR 180.000 - 240.000; Jornada completa

Descripción de la vacante

Creador is seeking a seasoned Platform/DevOps Engineer to own the multi-tenant LLM gateway and AWS-based infrastructure. You will manage CI/CD, security, and release engineering across cross-country teams, ensuring reliability and scalability.

You will lead incident response, capacity planning, and client IT security alignment, with a focus on least-privilege access, monitoring, and cost governance across cloud and SaaS services.

Formación

• Demonstrated DevOps or platform engineering experience supporting production infrastructure.

Responsabilidades

• Operating the multi-tenant LLM gateway on AWS ECS and ALB, including tenant pools, virtual keys, model allowlists, rate limits, metering and failover.
• Owning the AI provider account lifecycle across pooled subscription capacity: purchasing, OAuth linking and refresh, ban detection, replacement and seat forecasting.
• Owning CI/CD and release engineering — branching policy, preview-to-production promotion, CI gating, rollback — and reviewing infrastructure-affecting pull requests, codifying the standards product engineers follow.
• Owning cross-platform release engineering for the command-line installer, including version pinning, stable and prerelease channels, and macOS and Windows install verification prior to rollout.
• Owning incident response end to end — detection, triage, root cause, remediation and written post-incident reporting — and establishing runbooks and an on-call rotation across time zones.
• Owning secrets, identity and access: rotation of signing, inference and API keys, SSO integration, per-tenant tokens, and least-privilege scoping across GitHub, AWS, Vercel and Cloudflare.
• Owning observability across gateway, agents and ingestion, consolidating monitoring, tracing and evaluation tooling into dependable alerting rather than user-reported failure.
• Owning capacity and pipeline infrastructure: function timeouts, concurrency limits, durable workflows, batching, backpressure and storage retention.
• Owning the security and compliance engineering client IT requires: PII log redaction, network allowlisting, endpoint installation policy, and architecture and risk documentation.

Conocimientos

DevOps

Platform engineering

AWS

Docker

GitHub Actions

ECS

ALB

IAM

Vercel

Cloudflare

Terraform

CDK

Herramientas

Terraform

CDK

Docker

GitHub Actions

Vercel

Cloudflare

ECS

ALB

Descripción del empleo

Key Responsibilities

• Operating the multi-tenant LLM gateway on AWS ECS and ALB, including tenant pools, virtual keys, model allowlists, rate limits, metering and failover.
• Owning the AI provider account lifecycle across pooled subscription capacity: purchasing, OAuth linking and refresh, ban detection, replacement and seat forecasting.
• Owning CI/CD and release engineering — branching policy, preview-to-production promotion, CI gating, rollback — and reviewing infrastructure-affecting pull requests, codifying the standards product engineers follow.
• Owning cross-platform release engineering for the command-line installer, including version pinning, stable and prerelease channels, and macOS and Windows install verification prior to rollout.
• Owning incident response end to end — detection, triage, root cause, remediation and written post-incident reporting — and establishing runbooks and an on-call rotation across time zones.
• Owning secrets, identity and access: rotation of signing, inference and API keys, SSO integration, per-tenant tokens, and least-privilege scoping across GitHub, AWS, Vercel and Cloudflare.
• Owning observability across gateway, agents and ingestion, consolidating monitoring, tracing and evaluation tooling into dependable alerting rather than user-reported failure.
• Owning capacity and pipeline infrastructure: function timeouts, concurrency limits, durable workflows, batching, backpressure and storage retention.
• Owning the security and compliance engineering client IT requires: PII log redaction, network allowlisting, endpoint installation policy, and architecture and risk documentation.

Candidate Qualification and Experience

• Demonstrated DevOps or platform engineering experience supporting a production engineering team's infrastructure requirements.
• Deep working knowledge of AWS — ECS, ALB, IAM, RDS/Postgres, S3 — with Terraform or CDK, including migration of live services between providers.
• Practical experience with Docker, GitHub Actions, and managed platforms including Vercel and Cloudflare.
• Proven ownership of production incident response, monitoring and alerting, including root-cause analysis and post-incident reporting.
• Competence in secrets management, access administration and least-privilege token models across cloud and SaaS accounts.
• Capacity to act as sole infrastructure owner, setting standards without a supervising platform organisation.
• Experience operating API gateways or LLM proxies, including multi-tenant isolation, provider routing and failover.
• Experience in environments carrying PII-handling obligations and client-led security review.
• Familiarity with macOS and Windows endpoint tooling constrained by certificate inspection, execution policy and managed device fleets.
• Experience with cost governance across metered cloud and fixed-plan SaaS services.

Candidate Requirements

• Take unambiguous ownership of production systems, including failures originating with third-party providers.
• Prefer measured limits and documented practice to guesswork, replacing informal coordination with monitoring, runbooks and change control.
• Exercise sound judgement on build-versus-buy decisions, favouring proven managed services where economical.
• Communicate clearly with engineers, client IT teams and non-technical stakeholders during incidents.
• Introduce infrastructure standards alongside continuous client delivery, without halting the team's shipping cadence.