Principal Software Engineer (Platform/DevOps Engineering)

What You Bring:

• 12+ Years of experience across the Software Development lifecycle with a focus on platform engineering, DevOps, and cloud-native infrastructure.
• Proven IDP build experience: you have shipped or significantly contributed to a Backstage or Port portal (or equivalent) used in production.
• Deep Kubernetes expertise across EKS and AKS, including multi-tenant cluster design, Helm, Kustomize, and Crossplane.
• Experience with multi-tenant SaaS fleet management, cell-based architectures, and ring/canary deployment strategies.
• Strong proficiency in Go (Golang) or Python for building production-grade CLIs, custom operators, or platform backends.
• GitLab CI + ArgoCD / Argo Rollouts pipeline implementation experience—building CI/CD-as-a-service for engineering teams.
• Terraform / OpenTofu module authoring at scale—module registry design, state management, and refactoring large IaC codebases.
• Background in developing Backstage plugins or contributing to open-source developer platform ecosystems.
• Practical application of workload identity, SPIFFE/IRSA, and cloud-native zero-trust network architectures.
• Implementation of OPA/Gatekeeper/Kyverno for policy-as-code within production-grade Kubernetes clusters.
• Proficiency in FinOps methodologies and tools such as Kubecost or cloud cost exposure APIs.
• Experience managing Kafka or AWS MSK as a multi-tenant platform capability.
• Proven platform-first mindset with a history of centralizing scattered tooling into core foundation layers, evangelizing platform adoption, and collaborating effectively across developers, Embedded SREs, and Central SREs.
• Professional exposure to identity security frameworks, SaaS delivery, and high-compliance operational environments (SOC 2, ISO 27001, FedRAMP).

What You Will Be Doing:

Internal Developer Platform (IDP) & Developer Portal

• Take ownership of key aspects of the IDP architectural lifecycle, from service catalog creation to automated, self-service environment provisioning.
• Construct and manage a centralized developer hub featuring TechDocs, software catalogs, and seamless integrations with GitLab, Jira, and cloud management consoles.
• Develop and implement "golden-path" templates to rapidly deploy new microservices equipped with Kubernetes configurations, observability tools, and automated security guardrails.
• Champion and evangelize the adoption of platform products across engineering units using developer feedback, usage analytics, and active outreach.

Multi-Tenant SaaS Architecture & Fleet Operations

• Design and support cell-based deployment patterns and progressive ring-deployment strategies across multi-tenant and single-tenant customer fleets to isolate tenant workloads and limit blast radiuses.
• Automate continuous zero-downtime release deployments globally while providing platform abstractions that support multi-region SaaS deployments.

Platform-as-a-Service on Kubernetes

• Design and supervise multi-tenant Kubernetes environments on AWS EKS and Azure AKS, ensuring a unified cluster management experience for internal users.
• Produce modular Helm libraries and infrastructure compositions that mask underlying cloud complexities for product development teams.
• Enforce robust isolation and access control policies that reflect our multi-tenancy security framework at the namespace level.
• Maintain high availability through automated cluster lifecycle operations, including seamless scaling and blue/green deployment rotations.

GitOps, CI/CD, and Delivery Infrastructure

• Drive the evolution of CI/CD-as-a-service by providing standardized pipeline templates via GitLab CI and ArgoCD / Argo Rollouts for effortless team consumption.
• Deploy GitOps methodologies to establish default rollback capabilities, continuous drift detection, and transparent audit trails across environment workflows.
• Incorporate supply-chain security measures, such as container signing and SBOM creation, directly into our core delivery infrastructure.

API Gateway, Traffic Management & Edge Infrastructure

• Manage edge, ingress, and service-to-service communication infrastructure (API gateways, service mesh), incorporating built-in mTLS, rate limiting, distributed tracing context propagation, and circuit breaking as platform primitives.
• Configure global load balancing and edge protection (CDN/WAF) as standardized defaults across developer paths.

Infrastructure Automation & IaC

• Curate a centralized Terraform / OpenTofu registry for multi-cloud resources that adheres to stringent FinOps and security standards by default.
• Enable self-service infrastructure provisioning via Kubernetes-native workflows by implementing advanced provider compositions (Crossplane).
• Engineer custom Go-based CLI tools and operators to automate critical platform tasks, including cost tracking and credential rotation.

Platform Observability, FinOps & Resilience

• Launch a unified observability suite using Grafana, Prometheus, and OpenTelemetry to provide teams with essential self-service performance metrics.
• Establish logging and distributed tracing as foundational platform primitives, integrated automatically through standard developer paths.
• Create detailed FinOps reporting mechanisms and real-time cost anomaly guardrails to enable precise cloud expenditure attribution for teams and tenants.
• Integrate chaos testing and automated disaster recovery (DR) failover verification to meet strict enterprise SaaS uptime requirements.

Platform Security & Compliance Guardrails by Default

• Integrate zero-trust principles and workload identity into the platform fabric using short-lived credentials and cloud-native network policies.
• Utilize policy-as-code (OPA, Gatekeeper, Kyverno) and admission controllers to enforce security standards at the cluster level without impeding development velocity.
• Streamline secrets management by providing a secure, automated, self-service platform capability.
• Build compliance-as-code into CI/CD pipelines to automatically generate audit trails and SBOM documentation required for SOC 2, ISO 27001, and FedRAMP certifications.

Event-Driven & Messaging Infrastructure

• Manage shared messaging infrastructure systems like Kafka and AWS MSK, delivering topic provisioning and schema management as a robust platform service.
• Construct reusable patterns and scaffold templates that allow product teams to easily implement event-driven architectures from within the IDP.