{"id":1610673,"url":"https://alion.io/job/felix-pago-staff-platform-engineer-runtime-security","title":"Staff Platform Engineer (Runtime & Security)","company":{"id":175623,"name":"Félix Pago","domain":"felixpago.com","url":"https://alion.io/company/felix-pago","size_band":"11-50","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Gem","truth_index":null},"role":"DevOps","role_family":"DevOps","seniority":"staff","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"board_field","remote_working_hours":null,"hiring_geo_confidence":"structured","locations":[],"countries":[],"hiring_countries":["US"],"hiring_countries_total":1,"salary":null,"salary_estimate":{"min_usd":136000,"max_usd":264000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":122},"experience_years_min":8,"visa_sponsorship":false,"relocation_package":false,"has_equity":true,"technologies":[{"name":"AI Agents","optional":false},{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"BigQuery","optional":false},{"name":"CI/CD","optional":false},{"name":"ClickUp","optional":false},{"name":"GCP","optional":false},{"name":"GitHub","optional":false},{"name":"Google BigQuery","optional":false},{"name":"Google GKE","optional":false},{"name":"Google Workspace","optional":false},{"name":"Helm","optional":false},{"name":"Human-in-the-Loop","optional":false},{"name":"Istio","optional":false},{"name":"Kubernetes","optional":false},{"name":"Least Privilege","optional":false},{"name":"LLM","optional":false},{"name":"LLM Guardrails","optional":false},{"name":"LLMOps","optional":false},{"name":"New Relic","optional":false},{"name":"Notion","optional":false},{"name":"Ollama","optional":false},{"name":"OpenTelemetry","optional":false},{"name":"PagerDuty","optional":false},{"name":"Progressive Delivery","optional":false},{"name":"Python","optional":false},{"name":"Service Mesh","optional":false},{"name":"Slack","optional":false},{"name":"SQL","optional":false},{"name":"Terraform","optional":false},{"name":"Threat Modeling","optional":false},{"name":"Vertex AI","optional":false},{"name":"Zero Trust","optional":false}],"status":"live","first_seen_at":"2026-08-18T18:46:04Z","employer_posted_date":"2026-10-06","last_verified_at":"2026-10-16T21:47:26Z","board_verified":true,"closed_at":null,"days_open":59,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":59},"description":"About Us\nAt Félix, we are building the indispensable financial companion for Latinos in the US. We combine an AI-powered, conversational-first interface with real-time financial infrastructure to make cross-border money movement as easy as sending a text. Starting with fast, affordable remittances powered by AI and crypto rails, we are expanding into credit, savings, and wallet services to support the complete immigrant financial journey. Our ambition is to deliver a white-glove financial experience with the simplicity of a conversation to a community the traditional financial system has historically overlooked.\nWe are a hyper-growth Series C company, backed by over $300 million in funding from top-tier global investors, including Andreessen Horowitz, QED, Castle Island, Switch Ventures, HTwenty, Monashees, General Catalyst Customer Value Fund. This isn't just about the numbers; it's a testament to the trust our investors have in our vision and our team. Additionally, Félix was selected as an “Endeavor Entrepreneur” and was a recipient of the CrossTech Fintech Startups Award.\nJoining Félix means you will be part of a team building a legacy, a company that will outlive us all. This is a rare opportunity to apply your skills to a deeply meaningful mission-serving a community that has been underserved for too long because we are obsessed with our customers. We get things done with urgency and focus, driven by extreme ownershipover our impact. We collaborate without ego, fostering radical transparency and fierce loyalty so we can grow together. Because we aim for insanely greatrather than just good enough, we stay insatiably curious-always experimenting, building the future today, and delivering a product that truly makes our users' lives better.\nAbout the Role\nWe're looking for a highly technical Staff Platform Engineer to lead the platform and security foundations of Maestro - Félix's internal, identity-aware AI teammate. Maestro already runs at meaningful scale (500+ per-user pods on private GKE) and lives where work happens: Slack, incident rooms, and an emerging agentic intranet, acting across our toolchain (GitHub, Google Workspace, ClickUp, Notion, PagerDuty, New Relic).\nThe interesting problems here are not prompts or models. Once an AI teammate can open a pull request, page an engineer, or query production, the hard questions become identity, credentials, isolation, blast radius, and audit. This is a platform and security role for an agentic system - you'll own the secure, multi-tenant runtime that makes delegated AI work safe at scale.\nYou'll be the technical anchor for Maestro's infrastructure and security within the AI team: architecting the control plane, hardening the runtime, running the fleet, and shaping what the platform needs next as adoption grows. AI is the domain you'll operate in - deep platform and security engineering is the craft we're hiring for.\nResponsibilities\n Own the Maestro platform architecture. Design, build, and operate the multi-tenant control plane and per-user runtime on private GKE - the Kubernetes operators (CRDs/controller-runtime), Helm charts, gVisor-sandboxed pods, and per-user isolation primitives (KSA/GSA, Workload Identity, NetworkPolicy, per-user workspaces) that reconcile one user into a fully wired, isolated environment.\n Lead the security model end to end. Treat the LLM and its tools as adversarial. Own identity separation (requester / actor / persona), JIT short-lived scoped tokens, an encrypted OAuth refresh-token vault (CMEK/Cloud KMS), zero-credential egress patterns, and a policy layer that decides whosecredentials an agent uses - never the prompt.\n Harden service-to-service trust. Enforce mesh identity with Istio mTLS + SPIFFE, signed request claims (JWS) to prevent confused-deputy issues, and deny-by-exception networking across the fleet (Istio AuthorizationPolicy + Kubernetes NetworkPolicy).\nOperate the fleet, not the bot. Build fleet health, scale-to-zero, resource packing, and safe operational tooling for 500+ pods, with the SRE-grade availability, latency, and recovery the platform demands.\n Own IaC and delivery. Drive Terraform for the dedicated GCP projects (VPC, private GKE, GPU/gVisor node pools, Cloud SQL, Memorystore, GSM, Artifact Registry), plus CI/CD and progressive delivery for control-plane and runtime components.\n Make audit a product feature. Own the OpenTelemetry pipeline (logs/metrics/traces) fanning out to Cloud Logging, BigQuery, and New Relic, capturing gateway, kernel/gVisor syscall, and real-time SecOps events so \"who asked, which persona acted, which credentials were used, did the user confirm?\" is always answerable.\n Enforce human-in-the-loop and guardrails. Build the approval flows for irreversible actions (writes, merges, admin ops) and the read-only, model-immutable guardrail mounts (identity, instructions, curated skills).\n Integrate the agent layer, safely. Partner on the OpenClaw gateway, controlled tool wrappers, and model routing (Vertex AI for stakes, self-hosted Ollama for volume) - ensuring every agent capability is a governedcapability, not a raw CLI or API key.\nSet the technical direction. Define platform and security best practices, mentor senior and mid-level engineers, and map Maestro's next infrastructure needs as it scales.\nRequirements\nExperience: 8+ years in software/infrastructure engineering, with a proven track record owning large-scale, security-critical distributed systems end to end.\n Platform & Kubernetes mastery (Staff bar): Deep, hands-on Kubernetes in production - operators/CRDs and controller-runtime, Helm, runtime isolation (gVisor or equivalent), multi-tenancy, and fleet operations at scale. Strong cloud-native architecture on GCP (or AWS/Azure), and IaC with Terraform.\n Security & identity depth (Staff bar): Strong applied security engineering - workload identity (SPIFFE/SPIRE, Workload Identity Federation), service mesh mTLS (Istio), OAuth 2.0 / OIDC, token exchange, JIT/short-lived scoped credentials, secrets/KMS envelope encryption, least-privilege and zero-trust patterns, and threat modeling for adversarial workloads (confused-deputy, prompt injection, data exfiltration).\nSystems & code: Excellent Go and/or Python, with deep system-architecture judgment. Comfortable owning services, operators, and tooling in production.\n Observability & LLMOps: Production-grade monitoring, tracing, and audit design (OpenTelemetry), plus SRE fundamentals - SLOs, incident response, cost/performance engineering.\nOwnership & leadership: High autonomy in an early-stage squad - independently diagnose bottlenecks, propose architecture, and ship it. Proven ability to grow engineers through architectural guidance, not just code review, and to align technical decisions with stakeholders across Product, Security, and Leadership.\nNice to Have - AI Exposure: Prior hands-on experience with agentic systems or LLM infrastructure is a plus, but strong platform and security fundamentals take priority.\nThese are the applicable requisites, although equivalent competencies in any of the above will also be considered.\nWhat We Offer\nCompetitive salary\nInitial stock options grant\nAnnual performance bonus\nHealth, dental, and vision plans \n401(k) with employer match\nContinuous learning opportunities \nUnlimited PTO\nPaid parental leave\nEmpowering opportunities for growth in a dynamic entrepreneurial environment\nWhat We Offer\nCompetitive salary\nInitial stock options grant\nAnnual performance bonus\nHealth, dental, and vision plans \nContinuous learning opportunities \n401(k) with employer match\nUnlimited PTO\nPaid parental leave\nEmpowering opportunities for growth in a dynamic entrepreneurial environment\nEqual Opportunity Employer\nAt Félix, we are committed to providing equal employment opportunities to all qualified employees and applicants without regard to race, religion, nationality, sex, sexual orientation, gender identity, age, or disability. This policy applies to all terms and conditions of employment, including recruitment, hiring, placement, promotion, training, compensation, benefits, and termination.\nWant to learn more about our privacy practices? Check out our Privacy Policy.","description_format":"text","description_chars":8211,"description_truncated":false,"requirements":{"experience_years_min":8,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"phd","optional":false},"security_clearance":false,"languages":[]},"benefits":["Continuous learning","Parental leave","Stock options","Unlimited PTO"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Stablecoins","Money Transfer & Remittances"],"lifecycle":[{"event":"open","at":"2026-10-01T20:19:17Z"}],"visa":[],"liveness":{"score":37,"band":"fade","label":"Fading","p_open":1,"p_active":0.675,"p_room":0.55,"age_days":58,"expected_fill_days":49,"reasons":["conf:1","velocity","win:tail"],"computed_at":"2026-10-16T05:45:00Z"},"pay":null,"html_url":"https://alion.io/job/felix-pago-staff-platform-engineer-runtime-security","json_url":"https://alion.io/job/felix-pago-staff-platform-engineer-runtime-security.json","meta":{"generated_at":"2026-10-17T00:39:41Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":886,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-18T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":175623},"rest":"https://alion.io/mcp/rest/get_company?id=175623"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Ffelix-pago-staff-platform-engineer-runtime-security"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Ffelix-pago-staff-platform-engineer-runtime-security"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Ffelix-pago-staff-platform-engineer-runtime-security"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/felix-pago-staff-platform-engineer-runtime-security\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Ffelix-pago-staff-platform-engineer-runtime-security"}]}