Principal Platform Engineer - Hybrid/Remote

Midwestern

New York (NY)

Remote

USD 210,000 - 270,000

Full time

8 days ago

A complete application in a minute

Tailored resume and cover letter, ready to send.

Get past ATS filters

Job summary

Midwestern seeks a Principal Platform Engineer to lead platform architecture, infrastructure, and security for an AI-native development platform. You will own the substrate—IaC, pipelines, runtime, identity, network, security, telemetry, and cost—while mentoring engineers and driving governance. Travel required, varying by client.

You will shape multi-tenant isolation, gate frameworks, and SOC2/ISO 27001 evidence across products, coordinating with senior stakeholders and vendor partners.

Qualifications

15+ years in software/platform/infrastructure engineering or related field.
Deep hands-on expertise with infrastructure as code at fleet scale (Terraform/OpenTofu).
Experience operating multi-tenant Kubernetes in production with GitOps and tenant isolation.
Proven track record building CI/CD as a shared platform with gate enforcement.
Strong cloud security, identity, networking, and SBOM/security tooling knowledge.
Production observability experience (OpenTelemetry, SLOs, alerting).
Proficient in Go, Python, or TypeScript; strong testing, code review, and release management.
Excellent English communication; able to influence executives and teams.

Responsibilities

Drive platform architecture and runtime direction for a container-based, multi-tenant platform.
Design and publish fleet-scale infrastructure as code templates and images.
Automate environment lifecycle from PR to destroy with automatic cleanup.
Implement identity and network as a federated, credential-free model with just-in-time access.
Provide telemetry, cost visibility, and SLO-based governance for all services.

Skills

Python

TypeScript

Kubernetes

Terraform

CI/CD

Security-as-code

Observability

Cloud security

Agile

English fluency

Tools

Terraform/OpenTofu

GitHub Actions

OpenTelemetry

Snyk

Checkov

Trivy

OPA/Kyverno

Azure Policy

Backstage

Port

Job description

About the Role

Our client is a top-tier strategy and management consulting firm, the kind that competes with McKinsey, BCG and Bain for C-suite work. They are building an AI-native development platform that standardizes how code is generated, verified, secured, deployed, and monitored, so AI-assisted product development is safe and repeatable across its portfolio.

The Principal Platform Engineer sits at the intersection of infrastructure, delivery engineering, security, and developer experience. You will be accountable for the substrate every product - infrastructure as code, delivery pipelines and their gates, the runtime, identity and network, security and compliance controls, telemetry and cost, and the packaged development environment that carries our AI-assisted engineering harness.

This is a hands-on engineering and technical leadership position. You will move fluidly between building production infrastructure, architecting multi-tenant isolation, designing pipeline and policy enforcement, leading strategic architecture decisions, and mentoring engineers. Your success is measured by what every product inherits: a compounding system that outlasts your direct involvement. Travel is part of this position, but frequency may vary based on client, team, and individual circumstances.

What You'll Do:

Platform Architecture & Infrastructure Engineering

Drive the platform's architecture and runtime direction, including convergence onto one container-orchestrated runtime, tenancy-grade isolation between client engagements, and the contracts every product inherits.

Design composable infrastructure as code at fleet scale, with clear input contracts and state boundaries, published as versioned templates and images for every core component.

Make the environment lifecycle a one-command operation: created by merging a pull request, destroyed by deleting it, with automated proof nothing is left behind.

Design identity and network as a federated, credential-free system — one identity per engagement, just-in-time audited privileged access, separate internal and external edges.

Ship telemetry and cost visibility out of the box for every service: standard alerting, service-level objectives on live data, fault injection, and per-engagement cost attribution including AI spend.

Delivery Pipelines, Security & Compliance Engineering

Drive the shared delivery pipelines every product runs through, and the pluggable gate framework that quality, security, and AI-governance checks plug into with block-on-fail enforcement.

Implement security and compliance as code: release-blocking scanning on every repository, policy and admission control, signed and attested artifacts, and an audit trail and software bill of materials, including AI components, on every build as SOC2 / ISO 27001 evidence.

Package the AI-assisted development environment as a versioned, first-class deliverable, and enforce the sandbox boundary for coding agents: default-deny egress, short-lived credentials, isolated shared runners.

Run the platform as a product measured by developer outcomes — setup time, time to first commit, pipeline duration, gate false-positive rate, adoption — pruning or redesigning controls when governance burden outgrows benefit, and proving every golden path by shipping through it yourself.

Technical Leadership & Stakeholder Influence

Lead the platform's strategic architecture decisions — multi-tenancy, cloud posture, identity provider, network edge — as evidence-based decision documents with real trade-offs, and own the security and reliability evidence the program reports against.

Serve as a go-to technical authority on platform architecture and delivery engineering, consulted by senior stakeholders at the design and strategy stages, translating trade-offs and platform risk into actionable guidance, and mentoring engineers and vendor partners with observable improvement in design quality and production readiness.

What You'll Need:

15+ years for the Principal level and 10+ years for the Staff level - software engineering, platform or infrastructure engineering, or a closely related technical field.

Deep, hands-on expertise in infrastructure as code at fleet scale (Terraform or OpenTofu with Terragrunt or equivalent): module architecture, remote state, multi-environment topology.

Demonstrated experience operating multi-tenant Kubernetes platforms in production: GitOps, network and admission policy, workload identity, tenant isolation.

Proven track record building CI/CD as a shared platform (GitHub Actions or equivalent), with reusable workflow contracts, fleet-scale branch protection, and enforced quality and security gates.

Strong hands-on command of cloud identity and network security on Azure/AWS/GCP or a comparable hyperscaler: workload identity federation, RBAC, private networking, WAF, DNS.

Substantive experience with security and compliance as code: scanning toolchains (Snyk, Checkov, Trivy), policy engines (OPA, Kyverno, Azure Policy), supply chain controls (signing, provenance, SBOM), and SOC2 / ISO 27001 control evidence.

Production observability with OpenTelemetry or equivalent: collector topology, SLOs and error budgets, alert routing, incident management, fault injection.

Has built and operated production application software as a software engineer, in at least one of Go, Python, or TypeScript, and is fluent in testing strategy, code review, trunk-based delivery, and release management.

Excellent written and verbal communication skills in English; ability to translate complex technical topics to diverse audiences, including executive stakeholders.