Senior Platform Engineer

About the role

We are building a secure, central package management platform and need a Senior Platform Engineer to lead selection, rollout, and automation. You will work hands‑on within a small, self‑managed consultant team, delivering a reliable enterprise SaaS solution with minimal daily client oversight.

Key responsibilities

• Design, implement, and administer the chosen package management platform (JFrog Artifactory, Sonatype Nexus Repository, or Cloudsmith).
• Implement security controls such as upstream proxying, vulnerability and malware scanning, policy enforcement, license management, quarantine, and controlled promotion.
• Build integrations with GitHub Enterprise Cloud, Entra ID security groups, OIDC, and access‑provisioning workflows.
• Manage platform configuration, repositories, access models, and policies using Infrastructure‑as‑Code tools (Pulumi, APIs, etc.).
• Support developer enablement across ecosystems like NuGet, PyPI, CRAN, Maven/Gradle, npm, and Docker/OCI.
• Contribute to requirements gathering, technical validation, and implementation planning.
• Provide support for the interim JFrog Artifactory environment (~10% of effort).
• Produce clear technical documentation, operational procedures, and runbooks.

Required profile

• 5+ years of software development experience with deep knowledge of package consumption, build, publish, and troubleshooting.
• Hands‑on experience with at least one enterprise artifact management platform (JFrog Artifactory, Sonatype Nexus, or Cloudsmith).
• Proven ability to operate enterprise SaaS platforms, covering identity, access management, security, observability, and vendor support.
• Strong Infrastructure‑as‑Code / Configuration‑as‑Code mindset for managing platform state via APIs or Pulumi.
• Solid background in software supply‑chain security controls.

Required skills

• JFrog Artifactory, Sonatype Nexus Repository, Cloudsmith
• Pulumi, Infrastructure‑as‑Code, APIs
• Entra ID, security groups, SSO, OIDC, GitHub Apps
• NuGet, PyPI, CRAN, Maven, Gradle, npm, Docker, OCI
• Vulnerability scanning, malware scanning, license compliance, quarantine, promotion workflows