Infrastructure Engineer (Platform)

About Northwood:

Role
Northwood runs a global network of phased array ground stations supported by cloud infrastructure; clusters that run mission software, identity systems every service depends on, the observability stack that tells operators what is happening at every site, and the IaC that defines all of it. The Infrastructure Engineer – Cloud owns and operates that environment.
This is a core individual contributor role on the Infrastructure team. You take a defined scope, run it independently, and bring real depth in cloud infrastructure. You'll work directly with Platform software engineers building the services and config models that describe what the environment should be. You'll make that intent real in cloud infrastructure, and keep it running.

Responsibilities

• Own and operate all components of the cloud infrastructure stack: cloud accounts, hosted k8s clusters, CA, secrets, IAM, the observability pipeline. Take a defined scope and execute it without ongoing oversight.
• Build and maintain infrastructure as code. Define and implement GitOps practices and proper CI gates to test, audit, and approve infrastructure changes.
• Implement cloud-side networking: VPCs, transit route tables, VPNs and Direct Connect attachments, egress and ingress inspection. Partner with the network engineering on cloud to site handoff.
• Carry on-call for the cloud stack. Resolve the majority of incidents independently and run post-incident reviews for the ones you own.
• Partner with security engineering and compliance on controls implementation in your areas: policies, IAM boundaries, logging coverage, evidence collection, CVE mitigation.
• Treat toil as a design signal. When manual work repeats, automate it or fix the underlying system.
• Write and maintain runbooks, design docs, and component documentation. Keep them current with the system.
• Collaborate across infrastructure, platform software, security, and ground station operations on cross-cutting work.

Basic Qualifications

• 2–5 years of production infrastructure experience (SRE, DevOps, platform, cloud, or systems engineering). See Levels below for what we expect across that range.
• Depth in cloud: multi-account organizations, IAM, VPC networking, EKS or equivalent managed Kubernetes.
• Strong IaC experience: state management, CI-driven plan and apply, working in a shared monorepo with other engineers.
• Working competence across Linux, networking fundamentals, containers and Kubernetes, CI/CD pipelines, and observability tooling.
• Demonstrated end-to-end ownership of a production system: design, implementation, operation.
• On-call experience in a production environment with measurable reliability outcomes.
• Comfortable in code (Python, Go, or similar) for automation, tooling, and integration work.
• Strong technical writing: design docs, runbooks, post-mortems.

Preferred Qualifications
Depth in one or more of the following weighs heavily. We hire generalists with a spike.

• AWS GovCloud or other regulated or air-gapped cloud environments, including the service gaps and workarounds that come with them.
• Secrets and identity infrastructure: Vault (PKI, auth methods, policy design), Okta or IAM Identity Center integration, workload identity.
• Observability at scale: VictoriaMetrics or Prometheus, Grafana, alerting design, log pipelines (Vector, Loki).
• EKS: multi-cluster ArgoCD, cluster lifecycle, node and network policy, workload isolation.
• Cloudflare: Zero Trust, DNS, tunnels, WAF.
• Compliance partnership: implementing technical controls for CMMC, NIST 800-171, NIST 800-53, FedRAMP.
• Hybrid connectivity between cloud and on-prem or edge sites.

Additional Information:

To conform to U.S. Government space technology export regulations, including the International Traffic in Arms Regulations (ITAR) you must be a U.S. citizen, lawful permanent resident of the U.S., protected individual as defined by 8 U.S.C. 1324b(a)(3), or eligible to obtain the required authorizations from the U.S. Department of State.