Senior Backend Engineer
Confirmed on the employer's own hiring board on Oct 28, 2026. First seen by Alion on Oct 28, 2026. Dedagroup scores A on the Alion truth index.
We are one of the leading technology groups in Italy, with operations in the United States. We operate as a Business & Technology Accelerator for companies, financial institutions, and public sector organizations, supporting the evolution of their IT and digital strategies. Through an ecosystem of companies that share values, business strategies, and a common vision, we enable our clients to unlock the full potential of technology, amplifying its positive impact on both the economy and society. This role is dedicated to our US market.
What to expect
As our Cloud Platform Engineer, you own the environment other engineers build on, and you make a multi-platform estate tidy and well run. Ours is three: Google Cloud, a legacy Oracle Cloud we are retiring, and virtual machines on bare metal in a US data centre, still administered by hand-and we want the third to feel like the first. You design and operate landing zones on GCP, bring the bare-metal VM estate under configuration management and repeatable provisioning, and retire what remains on OCI, expressing the estate in Terraform and Ansible and shipping it through GitHub Actions, where CI runs on two repositories today -so you build that estate rather than inherit one. You run the shared services on top: Kubernetes, PostgreSQL, SQL Server, Keycloak, SeaweedFS, Grafana and Cloudflare. You are also the governance and FinOps function, at the stage where preventing sprawl is cheaper than unpicking it. Our products carry US credit-union member data, so confidentiality, integrity and availability are design constraints in every change. Reliability and toil reduction are in scope, but this is a platform and operations role first, not a pure SRE post. If you get satisfaction from a clean project hierarchy, IAM that reflects who needs what, an Ansible role that retires a runbook, and Terraform state you would hand to a stranger, this is your role. Your ultimate goal is to be the owner of the paved road, not a ticket-taker.
What you will do
Landing Zones & Estate Design: Design the project and compartment structure, network topology and organizational policy on GCP, and set the naming, tagging and environment standards while they are still cheap to establish-enforceable rather than aspirational.
Infrastructure as Code & Configuration Management: Extend Terraform from partial coverage to everything it reaches- modules, state, drift, imports on a live estate-and bring the VM estate under Ansible, with image builds and provisioning that make a machine rebuildable rather than remembered.
CI/CD on GitHub Actions: Build the pipelines that plan, review and apply infrastructure changes, and the reusable workflows that give product teams secure delivery without reinventing it per repository; two repositories have CI today, and the rest is yours to design.
Platform Services Operations: Run and evolve Kubernetes, PostgreSQL, SQL Server, Keycloak, SeaweedFS and Cloudflare as managed, documented, upgrade-able services-capacity, backup/restore and lifecycle-with PostgreSQL run through an operator covering replication, failover and tested restores. Prove recovery with disaster-recovery tests run for real, not on paper.
Observability & Incident Response: Build the Grafana dashboards, metrics, logs and alerting that make failures obvious before users report them, on an estate about to carry its first customers, and lead incident response, turning each incident into a guardrail.
Identity, Access & Security (CIA): Design least-privilege IAM across all three platforms, manage secrets properly, harden network and edge exposure, and keep access review, audit logging and change trails defensible when clients put their SOC 2 and GLBA questions to us.
FinOps & Housekeeping: Make spend attributable from the start-tagging, ownership, showback-so the bill can be explained line by line, and catch orphaned resources, forgotten environments and dormant repositories before they become archaeology.
Cross-Functional Enablement: Supply the paved road to a small, mostly junior team shipping AI and data products-Vertex AI, async pipelines, file ingestion-document it, and raise the risk early when a shortcut will cost us later.
What we expect from you
Public Cloud Depth: Significant hands-on experience operating a major public cloud in production-GCP strongly preferred -across compute, networking, storage and IAM. Prior OCI exposure is an advantage; willingness to operate and retire it is required.
Automation Below the Managed Line: You have automated machines, not only consumed services-Ansible playbooks, roles and inventories, image builds, and provisioning against bare metal, a hypervisor or a private cloud.
Terraform Mastery: Proven experience writing, structuring and maintaining real-world IaC-modules, state, drift, refactors on a live estate-not just applying someone else’s plans.
Kubernetes in Production: Workloads, networking, ingress, RBAC, resource management, upgrades, and debugging clusters when they misbehave. Self-managed control planes, not only managed ones, are an advantage.
CI/CD with GitHub Actions: Practical experience designing pipelines and reusable workflows rather than working inside someone else’s, including secure cloud authentication (OIDC/workload identity).
Security Mindset: Genuine command of least-privilege access, secrets management, network segmentation, and the CIA triad as applied to a regulated estate.
Scripting & Automation: Fluency in at least one automation language (Python preferred) for the glue work that IaC does not cover.
Ownership & Judgment: Accountable for monitoring, alerting, incident response and the hygiene that prevents incidents- without a platform team behind you-and able to refuse a bad request with an alternative and to document standards others follow without you in the room.
Nice to Haves: Cloud governance (organization policies, guardrails, tagging and naming compliance, provisioning approval flows); FinOps (showback and chargeback, commitment and discount management, right-sizing); Regulated environments (SOC 2, ISO 27001, GLBA, HIPAA or GDPR), particularly where a regulation shaped an architecture rather than producing a document; Keycloak (realms, clients, federation, OIDC/SAML) or a comparable identity provider; PostgreSQL operators such as CloudNativePG, PostgreSQL HA, backups and tuning, SQL Server administration, S3-compatible object storage such as SeaweedFS or MinIO, GPU scheduling or pipeline orchestration; Cloudflare (DNS, WAF, tunnels, zero-trust access) or equivalent edge security; Building Grafana stacks (Prometheus, Loki or similar) rather than consuming pre-built dashboards; Prior work at the Cloud or Platform Architect level-designing an estate and its standards, not just operating one; SRE practices (SLOs, error budgets, systematic toil reduction).