Platform Architect - Cloudnative

The Cloud-Native Platform Architect is the hands-on technical authority for SarvaGram's platform engineering function. You design and build, not just advise. You own the IAM/RBAC SDK that every squad uses for authentication. You design the AI SDK integration layer that allows lending engineers to call LLM APIs safely and consistently. You establish the infrastructure-as-code standards, the DevSecOps pipeline, and the observability framework that makes the squads faster without accumulating security debt. This is a platform-first identity role. You do not think of yourself as an infrastructure engineer who happens to write Terraform - you think of yourself as a platform engineer who builds the surfaces that product squads use. The distinction matters: your output is developer experience, not just uptime.

The core responsibilities for the job include the following:

Platform Engineering - SDK and Shared Services:

• Design and build the IAM/RBAC SDK - the authentication and authorization layer that every squad integrates with.
• Design and build the AI SDK integration layer - a consistent, secure interface for squads to call LLM APIs (Claude, OpenAI) with rate limiting, cost tracking, fallback handling, and PII guardrails built in.
• Own and evolve the API gateway configuration - routing rules, rate limiting, authentication enforcement, and observability instrumentation for all service-to-service and external API traffic.
• Define and maintain the shared platform services catalogue - what your squad provides as a platform capability (logging, tracing, feature flags, config management) versus what squads build themselves.
• Establish platform engineering standards and contribute to ADRs - documenting platform design decisions with context and rationale for the twelve squads that depend on these surfaces.

Infrastructure as Code and Cloud Architecture:

• Own SarvaGram's AWS architecture - VPC design, subnet segmentation, security groups, IAM roles, and the overall cloud topology that supports multi-environment (dev, staging, and production) deployments.
• Build and maintain a Terraform module library - reusable, versioned IaC modules that squads can use to provision their own resources consistently without requiring Atlas involvement for every change.
• Design the environment promotion strategy - how code moves from development through staging to production with appropriate gates, approvals, and rollback capabilities.
• Own RDS, ElastiCache, SQS, SNS, and S3 configuration standards - how databases are provisioned, backed up, and scaled; how message queues are configured for reliability and observability.
• Design disaster recovery and business continuity architecture - RTO and RPO targets defined, tested, and documented for an RBI-regulated financial institution.

DevSecOps and Security by Design:

• Build CI/CD pipelines that embed security scanning (SAST, SCA, container vulnerability scanning) as non-negotiable gates - not optional bolt-ons that slow delivery.
• Own secrets management architecture - how API keys, database credentials, and certificates are stored, rotated, and accessed across twelve squads without creating single points of compromise.
• Implement infrastructure compliance scanning - AWS Config rules, Security Hub findings, and automated remediation for common misconfigurations.
• Work with the CISO on application-layer security architecture - providing the infrastructure and SDK components that enforce the security policies.
• Establish the shift-left security culture on the platform side - every new infrastructure component is reviewed for security implications before deployment.

Observability and Platform Reliability:

• Design and implement the observability stack - distributed tracing (OpenTelemetry), structured logging, and metrics collectionthat gives twelve squads visibility into their services without each building their own.
• Define SLOs and SLAs for platform services - what reliability guarantees Phoenix and Atlas make to product squads, how they are measured, and what happens when they are breached.
• Build the on-call runbook library - documented incident response procedures for platform components that any engineer can follow at 2am without needing the Architect on the phone.
• Own the cost optimisation program - AWS cost visibility, rightsizing recommendations, reserved instance strategy, and FinOps practices appropriate for a growth-stage NBFC.

AI-Native Platform Practice:

• Pioneer AI-augmented platform engineering - use Claude for Terraform module generation, CI/CD pipeline configuration, runbook drafting, and infrastructure ADR authoring.
• Design the automation integration - how n8n workflows and AppSmith dashboards connect to platform infrastructure APIs safely and with appropriate access controls.
• Lead the Platform Guild - fortnightly sessions on cloud architecture, DevSecOps practices, and AI-augmented infrastructure engineering for DevOps engineers across Atlas.
• Consult with the Lending Platform Architect on infrastructure implications of lending domain designs - API gateway configuration, database topology, and observability requirements for lending services.

Requirements:

• 12 to 14 years in software/infrastructure engineering with at least 4 years in a platform or cloud architecture role - hands-on AWS experience is mandatory, not advisory.
• Has designed and built shared platform services that other engineering teams consumed - IAM libraries, observability frameworks, or deployment platforms; understands that developer experience is a product.
• Has built DevSecOps pipelines with embedded security scanning, not bolted-on audits - knows the difference between security theater and shift-left practice.
• Active AI tool user for infrastructure work - uses Claude or equivalent to generate Terraform, write runbooks, and explore architecture trade-offs today.
• Fintech or regulated industry experience is a meaningful plus - understands that RBI compliance and data localization constraints affect infrastructure decisions.

Mindset and Soft Skills:

• Platform-first identity: thinks 'how do I make 10+ squads faster and safer? ' ' not 'how do I keep the servers running? "'.
• Builder by default: reaches for code before PowerPoint - designs are expressed in Terraform, Go, and YAML, not just diagrams.
• Security by design: treats security as a platform feature, not a review gate - every new service has IAM, logging, and secrets management built in from day one.
• AI-native operator: uses Claude daily for IaC generation, runbook drafting, and architecture exploration - models this practice for the DevOps engineers in Atlas.
• Domain curiosity: Lending domain curiosity: interested in understanding why the lending platform makes the architecture demands it does - not just executing infrastructure tickets.

Technical Skills:

• AWS Platform - Mandatory.
• VPC / subnet / security group design and IAM / RBAC architecture.
• EKS / ECS container orchestration and RDS / ElastiCache / SQS / S3
• Terraform / IaC and AWS Config / Security Hub and CloudWatch / X-Ray / Open Telemetry.

Platform Engineering - Core:

• SDK design and development and API gateway (Kong / AWS API GW).
• CI/CD pipeline design (GitHub Actions / Jenkins) and Secrets management (Vault / AWS Secrets Manager).
• Service mesh (Istio / Linkerd) and Docker / Kubernetes and Python / Go for platform tooling.

DevSecOps - Core:

• SAST / SCA integration and Container security scanning.
• Shift-left security practice and Compliance-as-code.
• DevSecOps pipeline design and Incident response runbooks.

AI Native - Core Expectation:

• Claude / LLM API integration architecture and AI SDK design patterns.
• AI-augmented IaC generation and Prompt engineering for infrastructure tooling.

Skills

AWS, DevSecOps, IaC, Infrastructure as Code, Terraform