Staff Platform / Infrastructure Engineer

About the Role

webAI runs private AI on the customer's own hardware: on-prem Apple-silicon fleets (some air-gapped), Linux servers, and the customer's own cloud. As Staff Platform/Infrastructure Engineer, you'll own the substrate that makes this repeatable. That means how our kernel, services, and local model inference get packaged, deployed, secured, observed, and upgraded across bare metal and cloud. You'll inherit a production deployment serving a global enterprise customer, lead its move to a leaner next-generation architecture, and turn it into a deployment kit our forward-deployed engineers can use to install a new customer from the docs alone. This is a hands-on staff role: you'll make the architecture calls, write the code, and carry the pager.

Responsibilities

• Own deployment for the webAI kernel and B2B SDK.
• Deliver single-machine installs, multi-node clusters, and cloud (AWS, Azure/AKS) installs from one model, keeping the gap between cloud and bare metal small.
• Choose and evolve our orchestration approach (Nomad, Kubernetes, or config-managed native services such as Ansible plus launchd) with simplicity as the goal. Cut custom infrastructure code where you can.
• Run Apple-silicon fleets in production: launchd services, firewalling (pf), Lima/Docker VMs, GPU/unified-memory sizing for local LLM inference, and recovery after power loss or hardware failure.
• Build the inference serving layer with the AI team: an OpenAI-compatible model gateway, conversation-pinned load balancing, routing per model and per persona, and performance/load testing (throughput, time to first token, concurrency).
• Own the software supply chain: GitLab CI, container and OCI model artifacts, signing (cosign/minisign), pinned dependencies, mirrored registries for air-gapped sites, and the release process.
• Secure the platform: secrets management (Vault, KMS, cloud secret stores), PKI and mTLS, enterprise identity integration (Entra ID/OIDC, SCIM), and network policy for on-prem sites.
• Build observability and audit: metrics, logs, and alerting (Prometheus, Loki, Grafana), plus export of audit and telemetry into customer monitoring tools.
• Define what high availability means for us. Set reliability levels and SLOs we can commit to in customer contracts, then build them.
• Write the runbooks, "recipes," and RCAs that let forward-deployed engineers and customers operate the stack without you. Lead incident response when they can't.
• Work with kernel engineers on networking (QUIC/peer-to-peer connectivity, relays, NAT traversal) and on making the kernel easy to deploy.
• Mentor engineers and raise the bar for infrastructure-as-code, testing, and operations across the team.

Requirements

• 8+ years building and operating production infrastructure. At least some of it on bare metal or on-prem, not only managed cloud.
• Deep experience with at least one workload orchestrator (Nomad or Kubernetes), and the judgment to know when not to use one.
• Strong Terraform and configuration management (Ansible or similar). Clean state and environment management across staging and production.
• Production experience with AWS, Azure, or both (identity/IAM, KMS, container registries, managed Kubernetes).
• Solid networking fundamentals: WireGuard/Tailscale or other VPN overlays, firewalls, NAT, load balancers and L4/L7 proxies (e.g., Envoy), DNS, and TLS.
• Secrets and identity: Vault or equivalent, PKI/mTLS, OIDC.
• CI/CD and release engineering in GitLab: container builds, artifact signing, reproducible pinned builds.
• Observability: Prometheus/Grafana/Loki or equivalent, alert design, running on-call.
• Proficiency in at least one systems language (Rust or Go), plus scripting (Python/Bash).
• Clear technical writing: runbooks, design docs, and RCAs that others can act on.

Nice to Have

• macOS fleet administration at scale (launchd, pf, MDM-managed or locked-down environments, FileVault constraints).
• Running local LLM inference (llama.cpp, MLX, vLLM), GPU/unified-memory capacity planning, model packaging.
• Air-gapped or disconnected delivery: mirrored registries, offline installers.
• Peer-to-peer or QUIC networking (e.g., iroh, libp2p), relays, and NAT traversal.
• Writing Kubernetes operators/controllers or Nomad tooling (kube-rs, controller-runtime).
• Customer-facing deployment experience: installing and supporting software at customer sites.

Benefits

• Competitive salary and performance-based incentives
• Comprehensive health, dental, and vision benefits package
• Including a high-deductible HSA option with company contribution
• 401k match (US-based only)
• Flexible PTO Policy
• Parental leave for eligible employees
• Continuing education support
• Basic, company-paid life insurance
• Supplemental life insurance
• Company-paid short and long-term disability
• Free parking for in-office employees

Benefits may vary based on local law, country-specific requirements, and the employment platform or entity through which the employee is hired.