Note: The job is a remote job and is open to candidates in USA. Félix is building an AI-powered financial ecosystem for Latin immigrants in the U.S., including Maestro, an internal identity-aware AI teammate. The Staff Platform Engineer will lead Maestro's secure, multi-tenant platform and security foundations, including its Kubernetes runtime, control plane, identity and credential systems, fleet operations, infrastructure as code, observability, audit, and agent guardrails.
Responsibilities
- **Own the Maestro platform architecture.** Design, build, and operate the multi-tenant control plane and per-user runtime on private GKE — the Kubernetes operators (CRDs/controller-runtime), Helm charts, gVisor-sandboxed pods, and per-user isolation primitives (KSA/GSA, Workload Identity, NetworkPolicy, per-user workspaces) that reconcile one user into a fully wired, isolated environment
- **Lead the security model end to end.** Treat the LLM and its tools as adversarial. Own identity separation (requester / actor / persona), JIT short-lived scoped tokens, an encrypted OAuth refresh-token vault (CMEK/Cloud KMS), zero-credential egress patterns, and a policy layer that decides *whose* credentials an agent uses — never the prompt
- **Harden service-to-service trust.** Enforce mesh identity with Istio mTLS + SPIFFE, signed request claims (JWS) to prevent confused-deputy issues, and deny-by-exception networking across the fleet (Istio AuthorizationPolicy + Kubernetes NetworkPolicy)
- **Operate the fleet, not the bot.** Build fleet health, scale-to-zero, resource packing, and safe operational tooling for 500+ pods, with the SRE-grade availability, latency, and recovery the platform demands
- **Own IaC and delivery.** Drive Terraform for the dedicated GCP projects (VPC, private GKE, GPU/gVisor node pools, Cloud SQL, Memorystore, GSM, Artifact Registry), plus CI/CD and progressive delivery for control-plane and runtime components
- **Make audit a product feature.** Own the OpenTelemetry pipeline (logs/metrics/traces) fanning out to Cloud Logging, BigQuery, and New Relic, capturing gateway, kernel/gVisor syscall, and real-time SecOps events so "who asked, which persona acted, which credentials were used, did the user confirm?" is always answerable
- **Enforce human-in-the-loop and guardrails.** Build the approval flows for irreversible actions (writes, merges, admin ops) and the read-only, model-immutable guardrail mounts (identity, instructions, curated skills)
- **Integrate the agent layer, safely.** Partner on the OpenClaw gateway, controlled tool wrappers, and model routing (Vertex AI for stakes, self-hosted Ollama for volume) — ensuring every agent capability is a *governed* capability, not a raw CLI or API key
- **Set the technical direction.** Define platform and security best practices, mentor senior and mid-level engineers, and map Maestro's next infrastructure needs as it scales
Skills
- 8+ years in software/infrastructure engineering, with a proven track record owning large-scale, security-critical distributed systems
- Deep, hands-on Kubernetes in production — operators/CRDs and controller-runtime, Helm, runtime isolation (gVisor or equivalent), multi-tenancy, and fleet operations at scale
- Strong cloud-native architecture on GCP (or AWS/Azure), and IaC with Terraform
- Strong applied security engineering — workload identity (SPIFFE/SPIRE, Workload Identity Federation), service mesh mTLS (Istio), OAuth 2.0 / OIDC, token exchange, JIT/short-lived scoped credentials, secrets/KMS envelope encryption, least-privilege and zero-trust patterns, and threat modeling for adversarial workloads (confused-deputy, prompt injection, data exfiltration)
- Excellent Go and/or Python, with deep system-architecture judgment. Comfortable owning services, operators, and tooling in production
- Production-grade monitoring, tracing, and audit design (OpenTelemetry), plus SRE fundamentals — SLOs, incident response, cost/performance engineering
- Solid, hands-on experience with production LLM/agent systems — tool-calling, multi-step orchestration, human-in-the-loop, model routing, and eval/guardrail thinking
- You understand agentic architectures deeply enough to secure and operate them; you do not need to be a model researcher
- High autonomy in an early-stage squad — independently diagnose bottlenecks, propose architecture, and ship it
- Proven ability to grow engineers through architectural guidance, not just code review, and to align technical decisions with stakeholders across Product, Security, and Leadership
Benefits
- Initial stock options grant
- Annual performance bonus
- Health, dental, and vision plans
- 401(k) with employer match
- Continuous learning opportunities
- Unlimited PTO
- Paid parental leave
- Empowering opportunities for growth in a dynamic entrepreneurial environment
Company Overview
Company H1B Sponsorship