Senior Platform Engineer

Primary Function

This position has a start date in January 2027. We are accepting applications and interviewing now, and the selected candidate will begin work on or after January 4, 2027.

We are hiring a Senior Platform Engineer to design, build, and operate the delivery platform used across our enterprise IT organization. The platform is built on self-managed GitLab Ultimate and Azure managed services, including Azure Kubernetes Service, and it provides the shared CI/CD templates, security controls, and deployment automation that our containerized microservices depend on.

This is a collaborative role, and you will have significant influence over the platform's architecture as it is built out. You will work directly with developers and infrastructure engineers on how our services are built, tested, secured, and deployed. You will also define how GitLab is structured and governed, including across separate cloud environments with different compliance boundaries. Our standard is that infrastructure, pipelines, and access policy are defined as code, and that every change is reviewed through a merge request and applied by a pipeline. Part of this role is bringing the remaining manual processes to that standard.

Essential Duties

GitLab

• Install, upgrade, patch, back up, and restore self-managed GitLab Ultimate and the RHEL servers that host it and manage the GitLab runners and identity provider integration.
• Configure and administer GitLab add-ons and integrations, including GitLab Duo Enterprise.
• Deploy and configure new GitLab instances when required, including in separate cloud environments, and control which code, packages, and images move between them.
• Design the group and project structure of GitLab, including permissions, access tokens, and the placement of shared templates.
• Build the controls that enforce the organization's security and compliance requirements on every project, including security policy projects, approval rules, compliance frameworks, and protected branches, all managed as code.

CI/CD and security

• Own the shared CI/CD template library and project templates that every service builds and deploys from, and onboard new services onto the platform.
• Define and maintain container build standards, including multi-stage builds, minimal and hardened base images, non-root runtime users, and image scanning before images are pushed to the registry.
• Design pipeline structure and environment promotion, including merge request and branch pipeline rules, protected environments, deployment approvals, and validation jobs that run before and after each deployment.
• Integrate automated testing, code coverage, and the full GitLab Ultimate security scanning suite into the pipelines, including SAST, secret detection and push protection, dependency and license scanning, container scanning, infrastructure as code scanning, DAST, and API security testing.
• Set the thresholds that block a merge or deployment, and map test and scan results to secure development controls so that the pipeline produces the audit evidence.
• Introduce and operate automated dependency management across all repositories, so that library, base image, and tool updates are submitted as merge requests and tested by the pipeline before merge.
• Automate versioning, release, and rollback for applications, and keep the development and pipeline toolchain current, including SDKs, build and CLI tools, CI and base images, and the supported versions of GitLab, Kubernetes, and other platform components.

Kubernetes and Azure

• Administer AKS and the other Azure managed services the workloads use, including upgrades, ingress and Gateway API, network policy, workload identity, capacity, and backup.
• Define the Kubernetes deployment standards every service follows, including health probes, resource requests and limits, PodDisruptionBudgets, autoscaling, pod security context, and label and naming conventions.
• Support developers in deploying and troubleshooting containerized microservices built with .NET, Node.js, and React.
• Manage how configuration and secrets reach workloads and pipelines, including Key Vault integration, environment-specific configuration, protected and masked CI/CD variables, and build-time secret mounts.
• Define Azure resources, including identities and cluster configuration, in Terraform, OpenTofu, or Bicep, and help infrastructure teams convert manual procedures into automated, version-controlled processes.
• Automate TLS certificate issuance and renewal, define monitoring and alerting for GitLab (including its runners) and AKS, and diagnose and resolve platform failures.

Team practices

• Define the development team's source control practices (branching, merge request review, approvals), enforce them through GitLab settings, and review developer changes to pipelines, Dockerfiles, and Kubernetes manifests.
• Participate in the development team's Scrum ceremonies to plan deployments, prepare environments, and coordinate releases.
• Document platform architecture, standards, runbooks, and changes, and work alongside enterprise IT team members who are new to Git and to the platform tooling, including GitLab, to build their proficiency.

Supervisory Responsibilities

This position has no supervisory responsibilities.

Desired Knowledge, Skills & Abilities

• Experience with Azure Government and with operating platforms across multiple cloud environments that have separate compliance boundaries.
• Knowledge of NIST 800-171 or CMMC 2.0 controls and of STIG hardening for RHEL.
• Experience implementing software supply chain controls, including SBOM generation, image signing, hardened container images, and policy as code for Kubernetes and pipelines.
• Experience designing reusable infrastructure as code modules in Terraform, OpenTofu, or Bicep, including remote state management, drift detection, and plan and apply workflows that run through CI/CD pipelines with merge request review.
• Experience with Helm chart development, Kustomize overlays, and GitOps delivery.
• Experience with the Kubernetes Gateway API using Traefik or another implementation.
• Experience with automated dependency update tools such as Renovate or Dependabot.
• Experience managing Linux server configuration as code with a tool such as Ansible, Puppet, or Chef.
• Experience automating certificate management with ACME.
• Experience with Entra ID application registrations and with OAuth 2.0 and OIDC for APIs and single-page applications.
• Experience enforcing security and compliance requirements in GitLab with security policies and compliance frameworks.
• Experience administering Gitlab Self-Managed and GitLab Duo Enterprise.
• Proficiency in PowerShell for Windows automation, with the ability to write maintainable, tested scripts.
• Certifications such as CKA, CKS, RHCSA, RHCE, CompTIA Security+, or GitLab, Terraform, or Azure certifications.

Required Qualifications

• Bachelor’s degree in Computer Science, Management Information Systems, or a related field, or equivalent combination of education and experience.
• 7 or more years in DevOps, platform engineering, or infrastructure engineering.
• Hands-on GitLab CI/CD experience, including reusable templates that multiple projects consume (for example include, extends, rules, and needs).
• Administration of a self-managed GitLab instance, including new installations, upgrades, backup and restore, runners, and permissions.
• 5 or more years administering production Linux servers as the primary focus of your systems work, preferably RHEL, including systemd, SELinux, storage, and package management.
• Experience integrating automated tests, code coverage reporting, and security scanning into CI/CD pipelines, and tracking findings through remediation with developers.
• Production Kubernetes experience, preferably AKS, including deploying and troubleshooting containerized microservices, health probes, resource requests and limits, RBAC, and cluster networking and DNS.
• Experience writing and optimizing Dockerfiles, including multi-stage builds, minimal base images, and layer caching.
• Infrastructure as code with a tool such as Terraform, OpenTofu, or Bicep in a team setting.
• Strong Git fundamentals, including rebasing, merge strategies, conflict resolution, tags, and history rewriting. Experience helping team members recover lost or diverged commits.
• Experience defining branching, merge request review, and approval practices for a development team that works in Scrum.
• Proficiency in Bash or Python for pipeline tooling and automation, with the ability to write maintainable, tested code.
• Experience with Azure managed services such as AKS, Key Vault, Container Registry, and Azure Monitor.
• U.S. citizenship and eligibility to obtain a security clearance.

Working Environment

Work is performed in a normal office environment. The position requires extended periods of sitting and working at a computer. Occasional work outside normal business hours may be required to support scheduled maintenance, upgrades, and incident response.

PREFERENCE STATEMENT
Preference will be given to Calista shareholders and their descendants and to spouses of Calista shareholders, and to shareholders of other corporations created pursuant to the Alaska Native Claims Settlement Act, in accordance with Title 43 U.S. Code 1626(g).

EEO STATEMENT
Additionally, it is our policy to select, place, train and promote the most qualified individuals based upon relevant factors such as work quality, attitude and experience, so as to provide equal employment opportunity for all employees in compliance with applicable local, state and federal laws and without regard to non-work related factors such as race, color, religion/creed, sex, national origin, age, disability, marital status, veteran status, pregnancy, sexual orientation, gender identity, citizenship, genetic information, or other protected status. When applicable, our policy of non-discrimination applies to all terms and conditions of employment, including but not limited to, recruiting, hiring, training, transfer, promotion, placement, layoff, compensation, termination, reduction in force and benefits.
 
REASONABLE ACCOMMODATION
It is Calista and Subsidiaries' business philosophy and practice to provide reasonable accommodations, according to applicable state and federal laws, to all qualified individuals with physical or mental disabilities.
 
The statements contained in this job description are intended to describe the general content and requirements for performance of this job.  It is not intended to be an exhaustive list of all job duties, responsibilities, and requirements.
 
This job description is not an employment agreement or contract. Management has the exclusive right to alter the scope of work within the framework of this job description at any time without prior notice.