Principal Platform Engineer

• Principal-level, hands-on platform engineering role reporting to the Director of Platform Engineering
• Tech:
  Go, C#, Java or Rust, Hashi Corp Vault, Cloudflare, Entra , Terraform, OCI, AWS and Azure
• Fully remote, UK or Ireland
• Competitive salary plus bonus
• Design and code the secure hosting platform every product in a global fintech runs on

Our client is a fast-growing global fintech business whose technology helps businesses of all sizes get paid and grow. It operates at scale across multiple regions, in a highly regulated environment where security and reliability are non-negotiable. Engineering teams move quickly and are embracing AI-assisted development, and the platform they build on is seen as a genuine competitive advantage.

Platform Engineering builds and runs the secure hosting core that every product ships onto... effectively a private cloud spanning data centres, private cloud and public cloud, covering runtime, network, identity, secrets, edge, observability and recovery. As Principal Platform Engineer you design that platform and write the software that runs it. You'll think in systems, removing whole classes of security and reliability problems rather than fixing each instance, and turning every control into a measurable service level objective.

You'll work across Systems, Network, Dev Ops, Reliability and Information Security engineers, set the technical standards others build on, lead during major incidents and mentor senior engineers. It suits someone who still writes production code every day and uses AI agents as part of how they work.

• Design the secure hosting core across on-premises, private cloud, OCI, AWS and Azure, and own the architecture decisions behind it
• Lead the move from Active Directory to Entra , and build an internal identity platform for just-in-time and privileged access with PCI DSS and SOX audit evidence
• Design and run the certificate authority on Hashi Corp Vault, with mTLS between services and automated issuance and rotation
• Keep every secret in Vault with automatic rotation, secret scanning across the estate and 72-hour rotation of any credential
• Design and run external and internal DNS, including DNSSEC and zone migrations, with all origins locked down behind Cloudflare
• Build desired-state control planes that drive DNS, load balancers, firewalls, service discovery and cloud through their APIs, with drift detection
• Shift network and egress control to policy as code, leading zero trust network access and identity-based segmentation
• Build policy-as-code decision services and supply-chain controls, including signed artefacts, admission control and vulnerability gating
• Run the platform to SLOs and error budgets, owning telemetry, alerting, capacity planning, safe releases and tested, immutable recovery
• Lead design reviews, blameless incident reviews and on-call escalation, and mentor senior engineers

• Substantial experience as a senior or lead engineer designing, building and running production infrastructure platforms
• Expert in at least one statically typed backend language (C#, Java, Go or Rust), writing production code daily
• Hybrid and multi-cloud design across on-premises, private and public cloud, and how it fails
• Deep PKI and certificate authority experience, including CA hierarchy design, rotation and mTLS at scale
• Strong identity knowledge:
  Active Directory internals, Entra , OAuth 2.0, OIDC, SAML and privileged access
• Secrets management, workload identity and encryption in transit and at rest
• DNS (including DNSSEC and split horizon) and network security: TLS, firewalls, egress control, segmentation and zero trust
• SRE practice:…