Staff Platform / Infrastructure Engineer

Staff Platform/Infrastructure EngineerwebAI runs private AI on the customer's own hardware: on-prem Apple-silicon fleets (some air-gapped), Linux servers, and the customer's own cloud. As Staff Platform/Infrastructure Engineer you'll own the substrate that makes this repeatable. That means how our kernel, services and local model inference get packaged, deployed, secured, observed and upgraded across bare metal and cloud.You'll inherit a production deployment serving a global enterprise customer, lead its move to a leaner next-generation architecture, and turn it into a deployment kit our forward-deployed engineers can use to install a new customer from the docs alone. This is a hands-on staff role: you'll make the architecture calls, write the code and carry the pager.Responsibilities include:Own deployment for the webAI kernel and B2B SDK. Deliver single-machine installs, multi-node clusters, and cloud (AWS, Azure/AKS) installs from one model, keeping the gap between cloud and bare metal small.Choose and evolve our orchestration approach (Nomad, Kubernetes, or config-managed native services such as Ansible plus launchd) with simplicity as the goal. Cut custom infrastructure code where you can.Run Apple-silicon fleets in production: launchd services, firewalling (pf), Lima/Docker VMs, GPU/unified-memory sizing for local LLM inference, and recovery after power loss or hardware failure.Build the inference serving layer with the AI team: an OpenAI-compatible model gateway, conversation-pinned load balancing, routing per model and per persona, and performance/load testing (throughput, time to first token, concurrency).Own the software supply chain: GitLab CI, container and OCI model artifacts, signing (cosign/minisign), pinned dependencies, mirrored registries for air-gapped sites, and the release process.Secure the platform: secrets management (Vault, KMS, cloud secret stores), PKI and mTLS, enterprise identity integration (Entra ID/OIDC, SCIM), and network policy for on-prem sites.Build observability and audit: metrics, logs and alerting (Prometheus, Loki, Grafana), plus export of audit and telemetry into customer monitoring tools.Define what high availability means for us. Set reliability levels and SLOs we can commit to in customer contracts, then build them.Write the runbooks, "recipes" and RCAs that let forward-deployed engineers and customers operate the stack without you. Lead incident response when they can't.Work with kernel engineers on networking (QUIC/peer-to-peer connectivity, relays, NAT traversal) and on making the kernel easy to deploy.Mentor engineers and raise the bar for infrastructure-as-code, testing and operations across the team.Requirements & Skills:8+ years building and operating production infrastructure. At least some of it on bare metal or on-prem, not only managed cloud.Deep experience with at least one workload orchestrator (Nomad or Kubernetes), and the judgment to know when not to use one.Strong Terraform and configuration management (Ansible or similar). Clean state and environment management across staging and production.Production experience with AWS, Azure, or both (identity/IAM, KMS, container registries, managed Kubernetes).Solid networking fundamentals: WireGuard/Tailscale or other VPN overlays, firewalls, NAT, load balancers and L4/L7 proxies (e.g. Envoy), DNS and TLS.Secrets and identity: Vault or equivalent, PKI/mTLS, OIDC.CI/CD and release engineering in GitLab: container builds, artifact signing, reproducible pinned builds.Observability: Prometheus/Grafana/Loki or equivalent, alert design, running on-call.Proficiency in at least one systems language (Rust or Go), plus scripting (Python/Bash).Clear technical writing: runbooks, design docs and RCAs that others can act on.Nice to Have:macOS fleet administration at scale (launchd, pf, MDM-managed or locked-down environments, FileVault constraints).Running local LLM inference (llama.cpp, MLX, vLLM), GPU/unified-memory capacity planning, model packaging.Air-gapped or disconnected delivery: mirrored registries, offline installers.Peer-to-peer or QUIC networking (e.g. iroh, libp2p), relays and NAT traversal.Writing Kubernetes operators/controllers or Nomad tooling (kube-rs, controller-runtime).Customer-facing deployment experience: installing and supporting software at customer sites.We at webAI are committed to living out the core values we have put in place as the foundation on which we operate as a team. We seek individuals who exemplify the following:Truth - Emphasizing transparency and honesty in every interaction and decision.Ownership - Taking full responsibility for one's actions and decisions, demonstrating commitment to the success of our clients.Tenacity - Persisting in the face of challenges and setbacks, continually striving for excellence and improvement.Humility - Maintaining a respectful and learning-oriented mindset, acknowledging the strengths and contributions of others.Benefits:Competitive salary and performance-based incentivesComprehensive health, dental, and vision benefits package including a high-deductible HSA option with company contribution401k match (US-based only)Flexible PTO PolicyParental leave for eligible employeesContinuing education supportBasic, company-paid life insuranceSupplemental life insuranceCompany-paid short and long term disabilityFree parking for in-office employeeswebAI is an Equal Opportunity Employer and does not discriminate against any employee or applicant on the basis of age, ancestry, color, family or medical care leave, gender identity or expression, genetic information, marital status, medical condition, national origin, physical or mental disability, protected veteran status, race, religion, sex (including pregnancy), sexual orientation, or any other characteristic protected by applicable laws, regulations and ordinances. We adhere to these principles in all aspects of employment, including recruitment, hiring, training, compensation, promotion, benefits, social and recreational programs, and discipline. In addition, it is the policy of webAI to provide reasonable accommodation to qualified employees who have protected disabilities to the extent required by applicable laws, regulations and ordinances where a particular employee works.