Senior Systems Engineer

We are a global research and advisory firm that focuses on the world’s most consequential geopolitical and strategic matters. Our work informs the decisions of governments, institutions, and enterprises. We hold ourselves to unusually high standards. Our research is defined by empirical rigour and integrity. Our writing by clarity and authority. Our advisory work by genuine mastery of subject matter. We are a flat, expert-heavy team. Everyone operates at a high level, takes ownership, and is trusted to exercise judgment. The Role You will be responsible for the operational layer of a fast-moving, high-impact research and technology environment. You'll start as the senior engineer who runs and hardens the platform, reporting to the CTO, with the runway to develop further. You will work closely with our software engineers to maintain, harden, and evolve a modern stack: macOS/iOS user endpoints, Linux servers, AWS infrastructure, Cloudflare for edge services and ZTNA, and a sophisticated data analytics environment including a multi-DB lakehouse. You will operate and continuously improve all aspects of DevSecOps - including CI/CD, secrets management, IdAM, and security posture overall. You will architect as well as administer, automate as well as operate, and maintain an optimal estate as our team and systems scale — minimising click-ops. You will not be walking into a confused mess. We already operate a sophisticated and well-designed (but part-built) environment, with clarity on where we are going. E.g. deployments are health-gated with automatic rollback, CI runs on short-lived credentials rather than long-lived cloud keys, dependency and image updates arrive as automated, review-gated pull requests, and backups sit in deletion-locked vaults with cross-region copies. Your job will be to help us go further. Resilience — backup, DR, recovery, and the observability and incident response around them — is yours to own, and to keep proven. The environment: Linux-first (AWS Linux/Ubuntu), macOS and iOS end-user devices, AWS, cloud-native — workloads run predominantly as containers and IaC, not hand-tended servers; this includes isolated, segmented environments. Cloudflare: DNS, CDN, and Zero Trust (Access, Tunnels, WARP) end to end. AWS, multi-account: ECS/EC2, IAM, S3, networking, and governance — IaC via Terraform. Identity & endpoints: Entra ID, Intune (note this is not a Windows-centric role), Jamf. Databases: Aurora (OLTP), Iceberg/S3 tables, with numerous other analytical and graph databases and caches. CI/CD: GitHub Enterprise, Actions with security embedded in the pipeline. AI-native engineering: you use AI tools fluently and are comfortable operating alongside AI agents in the delivery loop. And much more besides. You You have at least five years of professional experience in building and running production systems. Ideally a tertiary qualification, but we value demonstrated skill more. You should have strong opinions about technologies and tools. A systems engineer first, an operator always. You have deep, evidenced experience running Linux and macOS environments in production — shown in the things you've actually built and shipped, and that you can walk us through in depth (a public GitHub or similar is welcome). You build the platform, you don't just tend it. You think in infrastructure-as-code and automation by default — Terraform, containers, CI/CD pipelines — and you treat click-ops as debt. You've designed and shipped systems that deploy, scale, and recover without someone standing over you. You automate what you administer. You script fluently in shell (bash/zsh) and Python. You believe the best systems run themselves, and you build toward that. Security is woven through the work, not a layer someone else owns. DevSecOps is how you build, not a separate discipline: e.g. Zero Trust access (Cloudflare Access/Tunnels/WARP), least-privilege IAM, federated identity (Entra/SSO/SCIM), secrets management and rotation, guardrails as code, and pipeline security in GitHub Actions — ephemeral credentials, secret-scanning, artefact integrity. You own resilience, and you prove it. Backup, disaster recovery, observability, and incident response are yours — kept honest by drill, not assumption. You instrument what you run, you know before your users do, and you've been the person in the incident, not just downstream of it. You understand the full stack beneath the application. Networking, DNS, TLS, databases — transactional and analytical. You might not be a DBA, but you speak SQL well enough to diagnose, optimise, and not break things. You work with AI, not around it. You use AI tooling — e.g. Claude Code — to go faster and build better, and you can contribute to the infrastructure that supports AI workloads. You are self-directed and intellectually honest. You find answers. You know when to go deep and when to ask. You're as comfortable presenting your thinking to an executive as you are debugging a misconfigured tunnel at 8pm. You take probity seriously. We work on sensitive topics. Discretion and confidentiality aren't policies to comply with — they're professional standards you hold yourself to. #J-18808-Ljbffr Garnaut Global