Senior Platform Engineer (Azure and AWS)
- Hiring from
- Europe
- Work type
- Remote
- Posted
620,637 remote jobs, straight from company career pages
100% free · New jobs every minute
Show job descriptionHide job description
Requirements:
- 6+ years in cloud, platform or DevOps engineering, with production work on Azure
- Solid production experience with AWS and ready to work across both clouds every day
- Private networking done properly: VNets and VPCs, Private Endpoints, PrivateLink, private DNS, hub and spoke, firewalls, routing between clouds without the public internet
- API gateways in production: Azure API Management policies, products, subscriptions and rate limits, or Envoy or Kong at a similar depth
- Identity and access: Entra ID, managed identities, RBAC, AWS IAM roles and cross-account access, least privilege by default
- Terraform as the main tool: modules, remote state, plans reviewed in pull requests, pipelines that apply them
- Containers and Kubernetes (AKS or EKS) in production
- Logs, metrics and traces set up for other teams to use: Azure Monitor, CloudWatch, OpenTelemetry
- Cost tags, budgets and alerts that show spend per team or use case
- Works inside a client's security and change process: security reviews, change approval, evidence for auditors
- Pairs with and coaches client engineers, writes runbooks that someone else can follow
- English C1 or higher, daily direct work with a US client
- Based in the EU (Poland or Czechia preferred) or in Brazil
Nice-to-Have:
- Azure API Management AI gateway policies for Azure OpenAI (token limits, token metrics, load balancing, semantic caching)
- LiteLLM, Envoy AI Gateway or another LLM gateway in production
- Azure OpenAI and Amazon Bedrock deployment types, quotas and data residency settings
- Cross-cloud connectivity: ExpressRoute, Direct Connect, private interconnect between Azure and AWS
- Workload identity federation between Azure and AWS
- Policy as code: Azure Policy, AWS Config, OPA or Checkov in CI
- Azure AI Content Safety, Bedrock Guardrails, Presidio
- Immutable storage and retention: Azure Blob immutability, S3 Object Lock
- Regulated environments: financial services, legal or healthcare (data residency, privileged data, audits)
- Certifications such as AZ-305, AZ-700, AWS Solutions Architect Professional or AWS Advanced Networking
Responsibilities:
- Expose through the gateway only the model deployments that match the data's residency rules
- Test one gateway across both clouds against one gateway per cloud under one policy set, measure latency, cost and operating load, and bring the result to the client's design authority
- Set up identity and least-privilege access for services and people, scoped by business line and engagement
- With the data and evaluation engineer, set up tracing, logs and an immutable evidence store in the right region
- Set up the cost meter: spend per key and tag, budgets and alerts per use case, cost per completed task
- Keep everything in Terraform and CI in the client's repos, write runbooks, prepare the evidence pack for the client's security review
About project
We build the first AI use case and the shared AI services (model gateway, agent and prompt registry, evaluation harness, provenance logging, data quality profiling) on the client's own Azure and AWS architecture.
This role builds the platform under all of it: one governed gateway for model access across Azure and AWS, private connectivity, identity, cost tracking and the infrastructure code. It pairs with client engineers so they can run and change the platform without us.
- 6+ years in cloud, platform or DevOps engineering, with production work on Azure
- Solid production experience with AWS and ready to work across both clouds every day
- Private networking done properly: VNets and VPCs, Private Endpoints, PrivateLink, private DNS, hub and spoke, firewalls, routing between clouds without the public internet
- API gateways in production: Azure API Management policies, products, subscriptions and rate limits, or Envoy or Kong at a similar depth
- Identity and access: Entra ID, managed identities, RBAC, AWS IAM roles and cross-account access, least privilege by default
- Terraform as the main tool: modules, remote state, plans reviewed in pull requests, pipelines that apply them
- Containers and Kubernetes (AKS or EKS) in production
- Logs, metrics and traces set up for other teams to use: Azure Monitor, CloudWatch, OpenTelemetry
- Cost tags, budgets and alerts that show spend per team or use case
- Works inside a client's security and change process: security reviews, change approval, evidence for auditors
- Pairs with and coaches client engineers, writes runbooks that someone else can follow
- English C1 or higher, daily direct work with a US client
- Based in the EU (Poland or Czechia preferred) or in Brazil
Nice-to-Have:
- Azure API Management AI gateway policies for Azure OpenAI (token limits, token metrics, load balancing, semantic caching)
- LiteLLM, Envoy AI Gateway or another LLM gateway in production
- Azure OpenAI and Amazon Bedrock deployment types, quotas and data residency settings
- Cross-cloud connectivity: ExpressRoute, Direct Connect, private interconnect between Azure and AWS
- Workload identity federation between Azure and AWS
- Policy as code: Azure Policy, AWS Config, OPA or Checkov in CI
- Azure AI Content Safety, Bedrock Guardrails, Presidio
- Immutable storage and retention: Azure Blob immutability, S3 Object Lock
- Regulated environments: financial services, legal or healthcare (data residency, privileged data, audits)
- Certifications such as AZ-305, AZ-700, AWS Solutions Architect Professional or AWS Advanced Networking
Responsibilities:
- Expose through the gateway only the model deployments that match the data's residency rules
- Test one gateway across both clouds against one gateway per cloud under one policy set, measure latency, cost and operating load, and bring the result to the client's design authority
- Set up identity and least-privilege access for services and people, scoped by business line and engagement
- With the data and evaluation engineer, set up tracing, logs and an immutable evidence store in the right region
- Set up the cost meter: spend per key and tag, budgets and alerts per use case, cost per completed task
- Keep everything in Terraform and CI in the client's repos, write runbooks, prepare the evidence pack for the client's security review
About project
We build the first AI use case and the shared AI services (model gateway, agent and prompt registry, evaluation harness, provenance logging, data quality profiling) on the client's own Azure and AWS architecture.
This role builds the platform under all of it: one governed gateway for model access across Azure and AWS, private connectivity, identity, cost tracking and the infrastructure code. It pairs with client engineers so they can run and change the platform without us.
