Lead Infrastructure and Security Engineer

Key Responsibilities

• Operating the multi-tenant LLM gateway on AWS ECS and ALB, including tenant pools, virtual keys, model allowlists, rate limits, metering and failover.
• Owning the AI provider account lifecycle across pooled subscription capacity: purchasing, OAuth linking and refresh, ban detection, replacement and seat forecasting.
• Owning CI/CD and release engineering — branching policy, preview-to-production promotion, CI gating, rollback — and reviewing infrastructure-affecting pull requests, codifying the standards product engineers follow.
• Owning cross-platform release engineering for the command-line installer, including version pinning, stable and prerelease channels, and macOS and Windows install verification prior to rollout.
• Owning incident response end to end — detection, triage, root cause, remediation and written post-incident reporting — and establishing runbooks and an on-call rotation across time zones.
• Owning secrets, identity and access: rotation of signing, inference and API keys, SSO integration, per-tenant tokens, and least-privilege scoping across GitHub, AWS, Vercel and Cloudflare.
• Owning observability across gateway, agents and ingestion, consolidating monitoring, tracing and evaluation tooling into dependable alerting rather than user-reported failure.
• Owning capacity and pipeline infrastructure: function timeouts, concurrency limits, durable workflows, batching, backpressure and storage retention.
• Owning the security and compliance engineering client IT requires: PII log redaction, network allowlisting, endpoint installation policy, and architecture and risk documentation.

Candidate Qualification and Experience

• Demonstrated DevOps or platform engineering experience supporting a production engineering team's infrastructure requirements.
• Deep working knowledge of AWS — ECS, ALB, IAM, RDS/Postgres, S3 — with Terraform or CDK, including migration of live services between providers.
• Practical experience with Docker, GitHub Actions, and managed platforms including Vercel and Cloudflare.
• Proven ownership of production incident response, monitoring and alerting, including root-cause analysis and post-incident reporting.
• Competence in secrets management, access administration and least-privilege token models across cloud and SaaS accounts.
• Capacity to act as sole infrastructure owner, setting standards without a supervising platform organisation.
• Experience operating API gateways or LLM proxies, including multi-tenant isolation, provider routing and failover.
• Experience in environments carrying PII-handling obligations and client-led security review.
• Familiarity with macOS and Windows endpoint tooling constrained by certificate inspection, execution policy and managed device fleets.
• Experience with cost governance across metered cloud and fixed-plan SaaS services.

Candidate Requirements

• Take unambiguous ownership of production systems, including failures originating with third-party providers.
• Prefer measured limits and documented practice to guesswork, replacing informal coordination with monitoring, runbooks and change control.
• Exercise sound judgement on build-versus-buy decisions, favouring proven managed services where economical.
• Communicate clearly with engineers, client IT teams and non-technical stakeholders during incidents.
• Introduce infrastructure standards alongside continuous client delivery, without halting the team's shipping cadence.