Platform Engineer

Who you are

• 5+ years of production cloud engineering experience on AWS, with deep familiarity across IAM, VPC, EKS, S3, KMS, and CloudTrail
• Hands-on experience operating inside a FedRAMP boundary (Moderate or High), not just compliance-flavored commercial AWS
• Strong Terraform skills, including module authorship that other engineers depend on without you in the room
• Production Kubernetes / EKS experience: cluster upgrades, RBAC design, network policy, autoscaling
• CI/CD pipeline ownership at production scale, including security gates (image scanning, dependency scanning, IaC policy)
• Production observability ownership at meaningful scale
• Experience building for reuse: platforms, modules, or paved-road tooling consumed by teams beyond your own
• Familiarity with cloud cost management at scale (reserved instances, savings plans, chargeback / showback)
• Strong customer-facing posture: comfortable in customer-context conversations about cloud and ATO posture
• Ability to obtain and maintain a U.S. Government security clearance
• AWS Solutions Architect Professional or DevOps Engineer Professional certification
• Direct GovCloud (US) production experience, particularly across the commercial-to-GovCloud boundary
• Experience contributing platform-side evidence to a FedRAMP authorization end-to-end
• Experience with internal developer platform (IDP) patterns (Backstage, paved-road tooling, golden-path templates)
• Direct background in security engineering or DevSecOps (security-heavy reqs route through this role)
• Familiarity with chaos engineering or fault injection tooling (AWS FIS, Gremlin)
• FinOps Certified Practitioner or equivalent practical FinOps experience
• Experience operating in IL5, IL6, or JWICS environments
• Active U.S. Government security clearance preferred (Secret minimum for most engagements; TS or TS/SCI required for a subset). Candidates without an active clearance must be able to obtain one. Clearance level will be confirmed at offer

What the job involves

• We are hiring a Platform Engineer to build and operate the cloud substrate our federal programs run on: the AWS and GovCloud account patterns, Kubernetes platform, Terraform module library, CI/CD paved roads, observability stack, and cost posture that new programs adopt on day one instead of rebuilding. Your work ships to multiple programs, and the leverage of the role is exactly that: a boundary pattern or golden-path template you harden once removes weeks of work and audit risk from every program that follows
• You will support the program teams that consume your platform and sit in customer-context conversations about cloud posture and ATO progress across engagements. This role is also the catalog destination for Security / DevSecOps-leaning reqs; when security on the platform-security seam is the primary signal, the loop adds a Domain Deep-Dive on ATO, threat modeling, and CI/CD security gates
• Design and maintain the reference cloud substrate: account structure, networking, and identity perimeter patterns that default to FedRAMP-aligned from day one and replicate across programs
• Build and own the shared Terraform module library as a product: versioned, documented, consumed confidently by program engineers you don't sit next to
• Operate the Kubernetes platform patterns programs adopt: cluster design, RBAC, network policies, autoscaling, upgrade strategy
• Build the CI/CD paved road (Bitbucket Pipelines, GitHub Actions, or AWS-native) with security gates built in, so program teams deploy self-service without reinventing the pipeline
• Build observability patterns that travel: the dashboards, alerting, and SLO scaffolding a new program inherits rather than assembles
• Own cloud cost across the portfolio: forecast it, govern it, and surface it to delivery leadership before it becomes a surprise
• Support program teams adopting the substrate, and harden the patterns based on what their deployments teach you
• Sit in customer-context conversations about cloud posture and ATO progress, representing the platform across programs
• Carry on-call for the shared platform surface you own