Senior AI Systems Engineer

cloudzero; United States; Hybrid; USD 180,000 - 240,000; Full time

Job summary

CloudZero is making a foundational hire in the Office of the CTO: you’ll build the data and AI platform the rest of the company operates on, delivering governed pipelines into Snowflake and a modeled surface analysts can query with confidence.

You’ll own the identity and event substrate—Okta, Jamf, Google Workspace, Slack, Jira, Ravenna—and establish cost attribution, RBAC, and governance across AWS, Snowflake, and SaaS. Hybrid from Boston, with some flexibility outside East Coast hours.

Job description

About the Role

CloudZero is making a foundational hire in the Office of the CTO: the person who builds the data and AI platform the rest of the company operates on.

Almost everything a team needs, whether it is the pipeline number, the churn signal, or the answer an agent gives a CS rep at 4pm, depends on data that today lives across dozens of SaaS systems and is moved by hand.

You’ll build the layer that ends that: governed pipelines into Snowflake, a modeled surface analysts and agents can query without guessing at joins, and the environments where agents run with real identity and real cost attribution.

You’ll also own the systems underneath it, including Okta, Jamf, Google Workspace, Slack, Jira, and Ravenna, because they’re the identity and event substrate that the platform inherits. The Okta group that provisions a new hire’s laptop is the same group that determines what an agent can access when that person invokes it. Whoever owns one should own both.

Hybrid out of our Boston office. Some flexibility outside East Coast hours helps, since our employees and customers are global.

How We Operate

Automation first. Manual work last.

Manual work shows up in two shapes here, and they’re the same problem: A ticket is a signal that a system failed a person. Ask why the question came up at all, and fix the upstream cause so the next ten people don’t hit the same wall.

A repeated request for a number is a data product that doesn’t exist yet. The third time someone pulls the same figure by hand, that’s not a favor to do, it’s a table you haven’t modeled.

The queue and the query log are both data. Instrument them, group by root cause, and let the pattern drive your roadmap.

We’re AI‑Native, For Real

You reach for Claude Code, Claude Desktop, or Cursor before problem‑solving manually, whether that’s drafting transformations, parsing logs, reasoning about a schema you’ve never seen, or breaking apart messy projects.

You can talk credibly about which models and tools are good at what, where they fall short, and how to prompt them well.

You try new tools as they show up, and drop them when they don’t earn their keep.

If writing a prompt is your default move when something looks unfamiliar, you’ll fit in.

What You’ll Own

The data platform Ingestion from our SaaS estate and cloud billing sources. CDC and ELT out of Salesforce/HubSpot, Jira, Okta, Ravenna, UKG, and support tooling, with schema drift handled and backfills that are boring.

The modeled warehouse: conformed dimensions, tested transformations, and a semantic layer where "ARR" resolves to one number regardless of who asks.

Data quality as a product concern: freshness SLAs, drift alerting, lineage. When a pipeline breaks silently, an agent confidently gives a VP the wrong answer.

Governance in the warehouse itself: Snowflake RBAC, row‑ and column‑level policy, and masking mapped to Okta groups, so access is inherited from identity rather than granted by ticket.

Cost visibility per team, per workload, per agent. We sell cost intelligence. Ours should be exemplary.

Data products other teams run on: Marketing attribution, Finance close support, Sales pipeline, and CS health, built as self‑serve surfaces rather than a request queue routed through you.

The retrieval layer agents depend on: chunking strategy, embedding pipelines, index freshness, and evaluation of retrieval quality. A stale index is a wrong answer with confidence.

The identity‑inheritance model, so an agent invoked by a CS rep or a finance analyst operates with exactly the permissions they have across AWS, Snowflake, and SaaS. Never more. No shared service accounts.

AI Landing Zones across AWS, GCP, Azure, and Snowflake: governed, self‑service environments where any department can deploy agents safely without being cloud engineers.

The developer experience for internal agent builders: templates, deploy paths, docs, and office hours that turn one team’s work into every team’s capability.

The systems underneath The core IT platform (Okta, Jamf, Google Workspace, Slack, Jira, Ravenna) run as a product with a roadmap and a shrinking manual surface.

Employee lifecycle automated end‑to‑end: joiners, movers, and leavers driven by HRIS as the source of truth, with no human in the loop.

The cloud perimeter: account structure, SCPs, IAM, and network segmentation for our major cloud providers (AWS, Azure, Snowflake), plus a Security partnership where new tooling is safe by default rather than safe by review.

What Your First Year Looks Like

Every system of record lands in Snowflake on a schedule people trust, with alerting that catches a break before a stakeholder does.

A modeled, documented core layer exists, and the first three teams outside Engineering answer their own questions against it.

Warehouse access is inherited from Okta groups rather than granted by request.

One agent is in production against that layer, running with its invoker’s permissions, with its cost attributed to a team.