Cloud / Platform Engineer (Kubernetes, GCP, AWS)

Supero.dev; San Francisco, Northern (CA, KY); Hybrid; USD 150,000 - 210,000; Full time

Job summary

Supero in San Francisco is seeking a Senior Cloud Platform Engineer to own the Kubernetes platform end-to-end. You will shape multi-cloud deployment patterns across AWS and GCP, manage the CI/CD lifecycle, and improve observability and cost awareness.

You’ll work with on-call challenges, build secure infrastructure, and implement IaC with Terraform and Python glue. The role emphasizes reliability, scalability, and boring deployments.

Qualifications

• 4+ years in cloud infrastructure, platform engineering or SRE, running production.
• Kubernetes past the tutorial — you can explain what you found during a 2am debugging session.
• AWS and/or GCP at depth, IAM included.
• Infrastructure as code, plus fluency in the shell and Python glue that real platforms are made of.
• CI/CD ownership and a bias toward making deploys boring.

Responsibilities

• Own the Kubernetes platform, including high-availability control plane, registry, deployment topology and manifests.
• Manage multi-cloud deploy paths across GCP and AWS with secure IAM handling.
• Develop preview and live environments with proper lifecycle separation and clear truth sources.
• Oversee CI/CD, release processes, image promotion, rollout and rollback.
• Improve observability and cost controls with meaningful alerts and scalable cloud billing.
• Maintain security posture covering secrets, network policy, TLS, CSP/CORS and tenant boundary.

Skills

Cloud infrastructure

Kubernetes expertise

SRE experience

CI/CD ownership

Shell scripting

Tools

AWS

GCP

Terraform

Datadog

Python (glue)

Job description

We deploy other people’s applications on demand — a generated app becomes a live URL. That is an infrastructure product hiding inside an application platform, and you would own it.

Why this role exists

We deploy other people’s applications on demand: a generated app becomes a live URL, on our infrastructure or inside the customer’s own AWS or GCP account. That is an infrastructure product hiding inside an application platform. It works, it is in production, and it has more shell script and less automation in it than a system this important should have. You would own it, and the mandate is to make it boring.

On call, honestly

There is no formal rotation today — today it is the founders and whoever last touched the thing. Building a real one, with a defined escalation path, alerts that mean something, and a rotation that includes engineers who are not you, is part of this job rather than something you inherit alone. We are not hiring one person to be the pager.

What you’ll own

• The Kubernetes platform. A high-availability control plane, our own registry, deployment topology, and the rendered manifests behind it.
• Multi-cloud deploy paths. GCP (Cloud Run, Cloud Build, GCS) and AWS (CodeBuild, ECR, App Runner/ECS). On GCP we deploy into the customer’s own project by impersonating a service account, with a confused-deputy guard that fails closed — no keys are ever created or stored. On AWS we still use a customer-issued IAM access key. Closing that gap is real, scoped work waiting for you.
• Preview and live environments. Ephemeral previews and long-lived production apps, which we separated properly after learning the hard way that they must not share a lifecycle. The open piece is that “is this app live?” still has two disjoint sources of truth — a backend record and five fields the browser writes — and no teardown path reconciles them. That one is yours.
• CI/CD and release. Build, image promotion, rollout, rollback — and making “which version is actually running in that pod” a five-second question.
• Observability and cost. Logs a human can find, alerts that mean something, and a cloud bill that scales with customers rather than with mistakes.
• Security posture. Secrets, network policy, TLS, CSP and CORS on served applications, and the tenant boundary at the infrastructure layer.

What we look for

• 4+ years in cloud infrastructure, platform engineering or SRE, running production.
• Kubernetes past the tutorial — you have debugged a cluster at 2am and can explain what you found.
• AWS and/or GCP at depth, IAM included. Especially IAM.
• Infrastructure as code, plus fluency in the shell and Python glue that real platforms are actually made of.
• CI/CD ownership and a bias toward making deploys boring.

Nice to have

Multi-tenant infrastructure. Cost engineering. Terraform. Datadog or equivalent. Having run someone else’s workload safely. Experience shipping software into someone else’s data centre — on-prem is single-VM today and the lanes beyond that are unbuilt, so that experience is worth a lot here.