Senior Platform Engineer

We are one of the leading technology groups in Italy, with operations in the United States. We operate as a Business & Technology Accelerator for companies, financial institutions, and public sector organizations, supporting the evolution of their IT and digital strategies. Through an ecosystem of companies that share values, business strategies, and a common vision, we enable our clients to unlock the full potential of technology, amplifying its positive impact on both the economy and society. This role is dedicated to our US market.

What to expect

As our Senior Platform Engineer, you join the core team that builds and runs the foundations under our products, and you own the environment every other engineer builds on. Ours spans three platforms: Google Cloud, a legacy Oracle Cloud we are retiring, and virtual machines on bare metal in a US data centre, still administered by hand—and we want the third to feel like the first. You design landing zones on GCP, bring the bare-metal estate under Terraform, Ansible and GitHub Actions, and retire what remains on OCI. You run the shared services on top and you are our DBA, owning backups, performance and upgrades. Today those services are Kubernetes, PostgreSQL, SQL Server, Keycloak, SeaweedFS and Grafana, and the list may change: knowing them helps, but we hire for the understanding underneath the tool and expect you to carry it across. You build and run the MLOps stack from the tech lead’s design: the data scientists decide what runs, and you make sure it runs. You are also the governance and FinOps function, at the stage where preventing sprawl is cheaper than unpicking it. The tech lead is your backup for holidays, sickness and incidents, and a second platform engineer joins once our customer base needs one. Our credit-union products carry US member data, so confidentiality, integrity and availability are design constraints in every change. This is a platform and operations role first, not a pure SRE post. If you get satisfaction from a clean project hierarchy, a restore test that passes, an Ansible role that retires a runbook, and Terraform state you would hand to a stranger, this is your role. Your ultimate goal is to be the owner of the paved road, not a ticket-taker.

What you will do

• Estate Design & FinOps: Design the project and compartment structure, network topology and organizational policy on GCP, set enforceable naming, tagging and environment standards while they are still cheap, and make spend attributable, catching orphaned resources and forgotten environments before they become archaeology.

• Infrastructure as Code & Configuration Management: Extend Terraform from partial coverage to everything it reaches— modules, state, drift, imports on a live estate—and bring the VM estate under Ansible, with image builds and provisioning that make a machine rebuildable rather than remembered.

• CI/CD & the Paved Road: Build the pipelines that plan, review and apply infrastructure changes, and the reusable GitHub Actions workflows that give every team secure delivery without reinventing it per repository; most repositories have no CI yet, so the pipeline estate is yours to design.

• Platform Services Operations: Run the shared services as managed, documented, upgrade-able services—capacity, backup/restore, lifecycle—bringing new ones in and retiring old ones cleanly, and prove recovery with disaster-recovery tests run for real, not on paper.

• Database Administration: Run PostgreSQL through an operator as our DBA—backups with tested restores, performance and query tuning, replication and failover, upgrades, access—and review schema changes for their impact on the database.

• MLOps Platform: Review the tech lead’s MLOps design to make sure it can be run, then build and run what it needs—a model registry, batch and online serving—alongside the Vertex AI workloads already on GCP.

• Observability & Incident Response: Build the Grafana dashboards, metrics, logs and alerting that make failures obvious before users report them, and lead incident response, turning each incident into a guardrail.

• Identity, Access & Security (CIA): Design least-privilege IAM across all three platforms, manage secrets properly, harden network and edge exposure, and keep access review, audit logging and change trails defensible when clients put their SOC 2 and GLBA questions to us.

What we expect from you

• Public Cloud Depth: Significant hands-on experience operating a major public cloud in production—GCP strongly preferred —across compute, networking, storage and IAM. Prior OCI exposure is an advantage; willingness to operate and retire it is required.

• Terraform & Ansible: Real-world Terraform—modules, state, drift, refactors on a live estate—and machines automated with Ansible: playbooks, roles, image builds and provisioning against bare metal, a hypervisor or a private cloud.

• Kubernetes in Production: Workloads, networking, ingress, RBAC, resource management, upgrades, and debugging clusters when they misbehave. Self-managed control planes, not only managed ones, are an advantage.

• Database Operations: You have been the DBA of a production relational database—PostgreSQL preferred; SQL Server, MySQL or Oracle count—through backups and restores, performance tuning, replication and failover, major-version upgrades and access control.

• MLOps Platform: You have run ML infrastructure as a service others rely on—a model registry, model serving or training pipelines—with the upgrades, capacity and access control any service gets; MLflow, Kubeflow, KServe, Seldon, BentoML, Vertex AI or SageMaker all count.

• CI/CD & Scripting: Pipelines and reusable workflows you designed on GitHub Actions, including secure cloud authentication (OIDC/workload identity), and fluency in an automation language (Python preferred) for the glue that IaC

  does not cover.

• Security Mindset: Genuine command of least-privilege access, secrets management, network segmentation, and the CIA triad as applied to a regulated estate.

• Ownership & Judgment: Accountable for monitoring, alerting, incident response and the hygiene that prevents incidents— with the tech lead as your backup, not a platform team behind you—and able to refuse a bad request with an alternative, raise the risk early when a shortcut will cost us later, and document standards others follow without you in the room.

• Nice to Haves: Cloud governance (organization policies, guardrails, provisioning approval flows); FinOps (chargeback, commitments, right-sizing); Regulated environments (SOC 2, ISO 27001, GLBA or GDPR); Keycloak or a comparable identity provider (OIDC/SAML); CloudNativePG or another PostgreSQL operator, and SQL Server administration; S3-compatible object storage such as SeaweedFS or MinIO, GPU scheduling or pipeline orchestration; Building Grafana stacks (Prometheus, Loki or similar); Prior work at the Cloud or Platform Architect level; SRE practices (SLOs, error budgets).