Senior Platform Engineer

** Primary Function
** This position has a start date in January 2027. We are accepting applications and interviewing now, and the selected candidate will begin work on or after January 4, 2027.We are hiring a Senior Platform Engineer to design, build, and operate the delivery platform used across our enterprise IT organization. The platform is built on self-managed Git Lab Ultimate and Azure managed services, including Azure Kubernetes Service, and it provides the shared CI/CD templates, security controls, and deployment automation that our containerized microservices depend on.

This is a collaborative role, and you will have significant influence over the platform's architecture as it is built out. You will work directly with developers and infrastructure engineers on how our services are built, tested, secured, and deployed. You will also define how Git Lab is structured and governed, including across separate cloud environments with different compliance boundaries. Our standard is that infrastructure, pipelines, and access policy are defined as code, and that every change is reviewed through a merge request and applied by a pipeline.

Part of this role is bringing the remaining manual processes to that standard.
** Essential Duties
**** Git Lab
* ** Install, upgrade, patch, back up, and restore self-managed Git Lab Ultimate and the RHEL servers that host it and manage the Git Lab runners and identity provider integration.
* Configure and administer Git Lab add-ons and integrations, including Git Lab Duo Enterprise.
* Deploy and configure new Git Lab instances when required, including in separate cloud environments, and control which code, packages, and images move between them.
* Design the group and project structure of Git Lab, including permissions, access tokens, and the placement of shared templates.
* Build the controls that enforce the organization's security and compliance requirements on every project, including security policy projects, approval rules, compliance frameworks, and protected branches, all managed as code.
** CI/CD and security
*** Own the shared CI/CD template library and project templates that every service builds and deploys from, and onboard new services onto the platform.
* Define and maintain container build standards, including multi-stage builds, minimal and hardened base images, non-root runtime users, and image scanning before images are pushed to the registry.
* Design pipeline structure and environment promotion, including merge request and branch pipeline rules, protected environments, deployment approvals, and validation jobs that run before and after each deployment.
* Integrate automated testing, code coverage, and the full Git Lab Ultimate security scanning suite into the pipelines, including SAST, secret detection and push protection, dependency and license scanning, container scanning, infrastructure as code scanning, DAST, and API security testing.
* Set the thresholds that block a merge or deployment, and map test and scan results to secure development controls so that the pipeline produces the audit evidence.
* Introduce and operate automated dependency management across all repositories, so that library, base image, and tool updates are submitted as merge requests and tested by the pipeline before merge.
* Automate versioning, release, and rollback for applications, and keep the development and pipeline toolchain current, including SDKs, build and CLI tools, CI and base images, and the supported versions of Git Lab, Kubernetes, and other platform components.
** Kubernetes and Azure
*** Administer AKS and the other Azure managed services the workloads use, including upgrades, ingress and Gateway API, network policy, workload identity, capacity, and backup.
* Define the Kubernetes deployment standards every service follows, including health probes, resource requests and limits, Pod Disruption Budgets , autoscaling, pod security context, and label and naming conventions.
* Support developers in deploying and troubleshooting containerized microservices built with .NET, Node.js, and React.
* Manage how configuration and secrets reach workloads and pipelines, including Key Vault integration, environment-specific configuration, protected and masked CI/CD variables, and build-time secret mounts.
* Define Azure resources, including identities and cluster configuration, in Terraform, Open Tofu, or Bicep, and help infrastructure teams convert manual procedures into automated, version-controlled…