Principal Platform Engineer ( Fully remote) Multiple hires
At-a-Glance
- Principal-level, hands-on platform engineering role reporting to the Director of Platform Engineering
- Tech: Go, C#, Java or Rust, HashiCorp Vault, Cloudflare, Entra ID, Terraform, OCI, AWS and Azure
- Fully remote, UK or Ireland
- Competitive salary plus bonus
- Design and code the secure hosting platform every product in a global fintech runs on
About the Company
Our client is a fast-growing global fintech business whose technology helps businesses of all sizes get paid and grow. It operates at scale across multiple regions, in a highly regulated environment where security and reliability are non-negotiable. Engineering teams move quickly and are embracing AI-assisted development, and the platform they build on is seen as a genuine competitive advantage.
The Role
Platform Engineering builds and runs the secure hosting core that every product ships onto… effectively a private cloud spanning data centres, private cloud and public cloud, covering runtime, network, identity, secrets, edge, observability and recovery. As Principal Platform Engineer you design that platform and write the software that runs it. You’ll think in systems, removing whole classes of security and reliability problems rather than fixing each instance, and turning every control into a measurable service level objective. You’ll work across Systems, Network, DevOps, Reliability and Information Security engineers, set the technical standards others build on, lead during major incidents and mentor senior engineers. It suits someone who still writes production code every day and uses AI agents as part of how they work.
Key Responsibilities
- Design the secure hosting core across on-premises, private cloud, OCI, AWS and Azure, and own the architecture decisions behind it
- Lead the move from Active Directory to Entra ID, and build an internal identity platform for just-in-time and privileged access with PCI DSS and SOX audit evidence
- Design and run the certificate authority on HashiCorp Vault, with mTLS between services and automated issuance and rotation
- Keep every secret in Vault with automatic rotation, secret scanning across the estate and 72-hour rotation of any credential
- Design and run external and internal DNS, including DNSSEC and zone migrations, with all origins locked down behind Cloudflare
- Build desired-state control planes that drive DNS, load balancers, firewalls, service discovery and cloud through their APIs, with drift detection
- Shift network and egress control to policy as code, leading zero trust network access and identity-based segmentation
- Build policy-as-code decision services and supply-chain controls, including signed artefacts, admission control and vulnerability gating
- Run the platform to SLOs and error budgets, owning telemetry, alerting, capacity planning, safe releases and tested, immutable recovery
- Lead design reviews, blameless incident reviews and on-call escalation, and mentor senior engineers
What You’ll Need
Essential:
- Substantial experience as a senior or lead engineer designing, building and running production infrastructure platforms
- Expert in at least one statically typed backend language (C#, Java, Go or Rust), writing production code daily
- Hybrid and multi-cloud design across on-premises, private and public cloud, and how it fails
- Deep PKI and certificate authority experience, including CA hierarchy design, rotation and mTLS at scale
- Strong identity knowledge: Active Directory internals, Entra ID, OAuth 2.0, OIDC, SAML and privileged access
- Secrets management, workload identity and encryption in transit and at rest
- DNS (including DNSSEC and split horizon) and network security: TLS, firewalls, egress control, segmentation and zero trust
- SRE practice: SLOs, error budgets, telemetry, incident command and rolling, blue-green and canary releases with automated rollback
- Experience building control planes with reconciliation and drift detection, plus clear technical writing (RFCs, API specs, post-incident reviews)
- Based in the UK with the right to work here
Desirable / Nice to Have:
- Cloudflare, HashiCorp Vault and Terraform (including custom providers), all managed as code
- Policy as code with OPA/Rego or Sentinel, and supply-chain security such as artefact signing and admission control
- AI-assisted engineering with Claude Code, Codex or Cursor, and building or reviewing tightly scoped MCP servers
Why Apply?
- Competitive salary 80-90k base + bonus
- Fully remote, UK/Ireland based
- Generous annual leave
- Comprehensive benefits package, details on request
- Principal-level influence: you set the standards the whole engineering organisation builds on
- A genuinely hands-on role, still writing code daily rather than drifting into management
- Shape how people and AI agents use the platform safely at scale
Next Steps
To find out more, contact Phil Gamble at or connect with Phil on LinkedIn or Whatsapp
WHJS1_NI
…