Staff Platform / Infrastructure Engineer

Join WebAI, a company that runs private AI on the customer's own hardware. As a Staff Platform/Infrastructure Engineer, you will own the substrate that makes this repeatable, including packaging, deploying, securing, observing, and upgrading our kernel, services, and local model inference across bare metal and cloud. You will lead the move to a leaner next-generation architecture and turn it into a deployment kit for our forward-deployed engineers. This is a hands-on role where you will make architecture calls, write code, and carry the pager.

• Ownership of the substrate that makes the deployment of the kernel, services, and local model inference repeatable across various environments.
• Leading the move of a production deployment serving a global enterprise customer to a leaner next-generation architecture and turning it into a deployment kit.
• Making architecture calls, writing code, and carrying the pager in a hands-on role, while also mentoring engineers and raising the bar for infrastructure-as-code.

• Running local LLM inference (llama.cpp, MLX, vLLM), GPU/unified-memory capacity planning, model packaging
• Proficiency in at least one systems language (Rust or Go), plus scripting (Python/Bash)
• MacOS fleet administration at scale (launchd, pf, MDM-managed or locked-down environments, FileVault constraints)
• Clear technical writing: runbooks, design docs and RCAs that others can act on
• Production experience with AWS, Azure, or both (identity/IAM, KMS, container registries, managed Kubernetes)
• Observability: Prometheus/Grafana/Loki or equivalent, alert design, running on-call
• CI/CD and release engineering in GitLab: container builds, artifact signing, reproducible pinned builds
• Strong Terraform and configuration management (Ansible or similar). Clean state and environment management across staging and production
• 8+ years building and operating production infrastructure. At least some of it on bare metal or on-prem, not only managed cloud
• Deep experience with at least one workload orchestrator (Nomad or Kubernetes), and the judgment to know when not to use one
• Solid networking fundamentals: WireGuard/Tailscale or other VPN overlays, firewalls, NAT, load balancers and L4/L7 proxies (e.g. Envoy), DNS and TLS
• Secrets and identity: Vault or equivalent, PKI/mTLS, OIDC
• Air-gapped or disconnected delivery: mirrored registries, offline installers
• Peer-to-peer or QUIC networking (e.g. iroh, libp2p), relays and NAT traversal
• Writing Kubernetes operators/controllers or Nomad tooling (kube-rs, controller-runtime)
• Customer-facing deployment experience: installing and supporting software at customer sites