Platform Engineer, Sandboxing and Air-Gapped Infrastructure

𝗥𝗲𝗺𝗼𝘁𝗲 (𝗳𝗼𝗿 𝗨𝗔𝗘 𝗖𝗼𝗺𝗽𝗮𝗻𝘆) · 𝗔𝗜 𝗣𝗿𝗼𝗱𝘂𝗰𝘁 & 𝗣𝗹𝗮𝘁𝗳𝗼𝗿𝗺 · 𝗘𝗻𝗴𝗶𝗻𝗲𝗲𝗿 𝗜𝗜𝗜, 𝗟𝟱 · 𝗠𝗝𝗗𝟬𝟵.𝟬.𝟭 Platform engineer who builds the 𝗲𝗻𝘃𝗶𝗿𝗼𝗻𝗺𝗲𝗻𝘁𝘀 𝗶𝗻 𝘄𝗵𝗶𝗰𝗵 𝗔𝗜 𝗮𝗴𝗲𝗻𝘁𝘀 𝗿𝘂𝗻, made for one task, closed to the network except where allowed and the same every time, and who makes the 𝘄𝗵𝗼𝗹𝗲 𝗽𝗹𝗮𝘁𝗳𝗼𝗿𝗺 𝗶𝗻𝘀𝘁𝗮𝗹𝗹𝗮𝗯𝗹𝗲 𝗶𝗻𝘀𝗶𝗱𝗲 𝗮 𝗱𝗮𝘁𝗮 𝗰𝗲𝗻𝘁𝗿𝗲 𝘄𝗶𝘁𝗵 𝗻𝗼 𝗰𝗼𝗻𝗻𝗲𝗰𝘁𝗶𝗼𝗻 𝘁𝗼 𝘁𝗵𝗲 𝗶𝗻𝘁𝗲𝗿𝗻𝗲𝘁, GPUs included. Greenfield. THE TECHNICAL CHALLENGE We build agents on open-weight LLMs that operate web applications through the browser. Each agent runs in an environment of its own, where it can do no harm. The environment is made for one task, the same every time and deleted afterwards. It reaches the network only where allowed, holds no credentials and records every action. The whole platform, GPUs included, has to be installable in a data centre with no connection to the internet. The engineering work is a control of outbound traffic that an agent cannot get around. The same work covers the updates after the first install and the sharing of GPUs between workloads. This role builds that environment and keeps it reliable. KEY RESPONSIBILITIES • Build the environment an agent and its browser run in: made for one task, isolated, torn down afterwards, the same every time, with environments prepared in advance so that a task starts without waiting • Enforce at the network layer what may leave the environment, where the agent cannot change it; keep credentials outside the environment; record every action in an audit log • Make the whole platform installable and updatable inside a data centre with no connection to the internet, GPU serving included: registries, signed images, certificates, installation media for updates • Provide the environment as a platform with stated guarantees and measured reliability DESIRED QUALIFICATIONS • A sandbox or execution service built on microVMs or a user-space kernel (Firecracker, Kata Containers, gVisor or comparable), with start time, number per host and reset time measured • A platform delivered into a site with no connection to the internet and kept up to date there: registries, package mirrors for GPU drivers, signed images, certificate rotation, update media • Open-weight models served on a few GPUs of one's own, with the sharing between workloads chosen deliberately and utilisation measured • Contributions to Firecracker, Kata Containers, gVisor, Cloud Hypervisor, Cilium, Talos, Zarf or Hauler EXPECTED QUALIFICATIONS • T-shaped: deep in one domain, with working breadth in a neighbouring one • Structures a large, incompletely specified problem and drives it to a working result independently; understands that updating an installed platform is harder than the first install • Kubernetes run in production with network policy, storage and upgrades, incidents handled; isolation technologies (gVisor, Firecracker, Kata or comparable) used deliberately, with the trade-offs understood; uses AI coding tools daily and verifies their output • Outbound control built at the network layer, with secrets kept outside the workload and a written account of how it was tested —— HOW WE WORK • Product engineering: we own what we build and run it in production • Small teams, two-week cycles, working software at every review • AI coding tools are part of the standard workflow WHAT WE OFFER • Founding-team scope • AI-augmented engineering environment • Access to on-premise Nvidia B200s • Flexible work environment PROCESS • Introductory call • Technical conversation • Practical session; the format is agreed with you In coding exercises, AI tools are allowed and expected. No LeetCode. WHO WE ARE New product organisation as part of a large semi-government in Abu Dhabi. International, ex-FAANG team. Completely greenfield, with a modern tech stack. —— REQUIREMENTS TO BE CONSIDERED • Clear written and spoken English • 5+ years in platform, infrastructure or reliability engineering; own infrastructure operated in production, with on-call; comfortable in Python or TypeScript and shell • Linux, containers and networking understood deeply enough to debug them during an incident; one system the candidate built and can show • Bachelor's degree in any field, or self-taught with a track record of open-source contributions RELATED TECHNOLOGIES AND CONCEPTS • Runtime: Kubernetes, Helm, operators, the Kubernetes agent-sandbox project, gVisor, Firecracker, Kata Containers, Cloud Hypervisor, warm pools, snapshot and restore • Network and security: network policy, Cilium or comparable, TLS interception, egress proxies, certificate authorities, OpenBao or comparable secrets management, audit logging • Installation without internet: Zarf, Hauler, RKE2, Talos, image registries and mirrors, signed images, infrastructure as code, GitOps • Serving: NVIDIA GPU Operator, MIG and time-slicing, vLLM and SGLang, object storage (RustFS or comparable)