AI Platform Engineer

We are a specialized technology staffing agency supporting professional and financial services companies. Why do we stand out in technology staffing? We listen and act as advisors for our candidates on how they can best add value, find interesting projects, and pave a path for career advancement. We advocate for the best pay, diversity in tech, and the best job fit for every candidate we place. Our client, a global private equity firm, is seeking an AI Platform Engineer to join their team in San Francisco, CA! The firm is building an in‑house citizen development platform that enables non‑engineering employees to deliver secure, auditable internal applications using AI‑assisted tooling. As an AI Platform Engineer, you will own the technical foundation that makes this possible: the sanctioned scaffolds, the agentic guardrails, the CI/CD controls, and the Azure infrastructure that every internal application is built on. Responsibilities: Scaffold Library & Agentic Guardrails Design, maintain, and version the firm’s sanctioned scaffold templates (static‑site and web‑app‑sql at launch) that every internal application is instantiated from. Author and evolve CLAUDE.md files that encode architectural constraints for Claude Code — defining allowed patterns, anti‑patterns, directory structures, audit‑log contracts, and MCP allowlists. Develop and maintain the devcontainer configurations (.devcontainer) that standardize Codespaces environments across all projects. Establish and enforce the scaffold selection and versioning process, including drift‑detection CI checks that alert when applications diverge from their scaffold baseline. Govern the Cowork plugin and skill catalog used by Track B citizen developers, ensuring it mirrors the governance discipline of the Track A scaffold library. CI/CD & Automated Quality Controls Own and extend the GitHub Actions pipeline stages: build, CodeQL SAST, secret scanning, Dependabot/dependency review, Claude Code Action security review, Bicep what‑if, architectural drift detection, and deployment to Azure. Build and maintain automated material‑change detection logic that routes PRs requiring human review to the technical reviewer, and allows routine PRs to self‑serve through CI. Configure and tune GitHub Advanced Security (CodeQL, secret scanning with push protection) to minimize false positives while maintaining high‑severity blocking. Implement and evolve architectural‑drift checks: scaffold version presence, per‑file size budgets, audit‑log conformance, inline‑literal detection, and public‑ingress guards. Design the Claude Code Action security review integration, including the security‑focused system prompt that references each application’s threat model. Own the Bicep module library for common Azure patterns: App Service with VNet integration, Azure SQL with private endpoints, Key Vault with managed‑identity access, Application Insights, and Log Analytics. Maintain OIDC workload identity federation between GitHub Actions and Azure — no stored service principal secrets in pipeline variables. Configure and govern Azure App Service Easy Auth with Microsoft Entra ID, including Conditional Access policy integration and deployment‑slot management for zero‑downtime production swaps. Manage the network security posture: VNet private endpoints for SQL and Key Vault, Codespace egress allowlists, and private inbound endpoints for production applications. Instrument Application Insights and Log Analytics for all platform applications; author Sentinel analytic rules for auth failures, bulk‑read events, off‑hours writes, and Entra group‑membership changes. Identity & Access Management Configure and maintain GitHub Enterprise Cloud with Enterprise Managed Users (EMU), including SAML SSO and SCIM provisioning against Microsoft Entra ID. Design Entra group structures for each application (users, editors, importers, reviewers) and ensure group lifecycle is tied to the SDLC onboarding checklist. Enforce Conditional Access policies across GitHub, Codespaces, and Azure App Service — compliant Intune‑managed device, MFA, and corporate network egress as standard gates. Audit and maintain the Claude Code MCP allowlist and settings.json configurations checked into each repository’s /.claude directory. Act as architect‑on‑call for the citizen development program: onboard new applications, approve material‑change PRs, confirm production slot swaps, and conduct quarterly CI‑signal spot‑audits. Pair with citizen developers on their first PR to demonstrate the iterate‑on‑CI‑signal workflow. Develop and maintain the onboarding checklist for new applications (scaffold selection, Entra group setup, runbook authoring, data classification) and new citizen developers. Translate failure modes observed in production or PR review into new automated CI checks propagated via scaffold versioning — the escalation path is never “add more human review.” Required Qualifications: 5+ years of software engineering or platform/infrastructure engineering experience. Strong working knowledge of GitHub Actions and CI/CD pipeline design, including branch protection rules, environment gates, and OIDC federation. Hands‑on experience with Microsoft Azure: App Service, Azure SQL, Key Vault, VNet, private endpoints, and Application Insights. Experience with Infrastructure as Code; Bicep or ARM template experience preferred. Proficiency with Microsoft Entra ID (formerly Azure AD): SSO, SCIM provisioning, Conditional Access policies, and managed identities. Demonstrated ability to configure and govern GitHub Enterprise Cloud, including branch protection, GitHub Advanced Security (CodeQL, Dependabot, secret scanning), and audit log streaming. Familiarity with agentic AI coding tools (Claude Code, GitHub Copilot, or equivalent) — you understand how these tools interact with codebases and where they create risk. Strong security instincts: you think in threat models, not just feature checklists. Preferred Qualifications: Experience designing developer platforms or internal tooling for non‑engineering users. Working knowledge of Next.js (App Router) and modern TypeScript web application patterns. Experience writing CLAUDE.md or similar agent‑constraint configuration for AI coding assistants. Background in financial services, private equity, or other environments where data classification and audit requirements shape engineering decisions. Familiarity with Microsoft Sentinel, Log Analytics KQL queries, and Defender for SQL. Experience with GitHub Codespaces administration, including devcontainer design and prebuild configuration. #J-18808-Ljbffr Eleven Recruiting