Typically, six or more years across DevOps, platform, security, or operations-heavy engineering, with autonomy to own outcomes end-to-end and set standards from scratch.
Experience building and securing production cloud infrastructure on AWS, with least-privilege practices, automation, and infrastructure-as-code.
Systems thinking and an instinct to automate repeated toil.
Experience owning security posture and reliability; experience in a regulated or compliance-sensitive environment is advantageous but not required.
Comfort owning corporate IT and device-fleet systems, using automation for mobile device management, zero-touch provisioning, and identity lifecycle.
Ability to communicate trade-offs clearly, make pragmatic fit-for-stage decisions, and act as the founding owner setting standards.
Strong cloud and security fundamentals and ability to learn; specific certifications and industry background are not required.
Responsibilities
Drive least-privilege access through scoped IAM roles, secrets management, network segmentation, and clear access accountability.
Embed security as a design constraint across infrastructure and CI/CD, shifting security checks earlier in delivery.
Establish and own a fit-for-stage security posture trajectory toward certification against leading standards.
Lead vulnerability management, dependency and image scanning, penetration testing, and incident response.
Own security findings service-level agreements, with critical findings addressed within one business day and high findings within two, tuning scanning and penetration-testing tools for accurate signals and monitoring adherence.
Implement zero-trust access by isolating internal tools from the public internet and allowing access only to verified staff on managed devices.
Improve AWS security posture with scoped roles, short-lived credentials, and no long-lived keys.
Automate security patching for dependencies and container images.
Monitor for unusual access and behavior and run rehearsed incident response.
Run quarterly reviews, secret rotation, disaster-recovery tests, and maintain current evidence for audit, funder, and regulatory questions.
Own the reliability posture of the core lending platform, including uptime targets, incident management, and blameless post-mortems.
Define and test disaster recovery and business continuity, including documented recovery-point and recovery-time objectives, failure runbooks, and regular game days.
Own infrastructure-as-code and the deployment pipeline to make production releases fast and safe.
Reduce engineering friction so teams can ship multiple times a day; use architecture and tooling to increase velocity.
Remove bottlenecks in build, test, and deployment processes, including verification and deployment of agent-written code.
Provide agents with production-like preview environments for testing and verification.
Operate corporate IT as an automated system, including zero-touch device provisioning, mobile device management, endpoint security, and self-healing fleet configuration.
Automate onboarding and offboarding so new starters are securely set up on their first day.
Own identity and access systems, including single sign-on, multi-factor authentication, lifecycle management, and evidenced, largely automated access reviews.
Build lightweight IT processes that scale from approximately 50 to more than 200 people.
Own device security alerts and quarantine through Rippling mobile device management.
Shift security and reliability work toward policy-as-code, automated remediation, and agent-assisted triage within deterministic guardrails.
Define and verify guardrails for self-securing systems, with human verification for high-stakes changes.
Review high-impact work as agents support detection and access-anomaly response, patch dependencies and images, rotate secrets, and assemble audit evidence.
Desired Qualifications
Experience with policy-as-code, detection-as-code, agentic or automated operations, or building self-healing systems.
Mission:
Skip is building the fastest, most intelligent home loan platform in Australia - on infrastructure that has to be both fast to iterate on and genuinely robust in a regulated lending environment. We are looking for a Founding Platform Engineer, our first dedicated platform and security hire. The job is to make sure our platform is secure, reliable, and observable by default - and to build it so that staying that way takes less human effort over time, not more. That includes how code reaches production: the CI/CD pipeline and deployment controls that let engineers and agents ship many times a day without trading off safety.
About the role:
Most "DevOps" job descriptions describe someone who runs infrastructure and fights fires. This role is about building the harness that runs the infrastructure - so security, reliability, provisioning and deployment increasingly enforce themselves.
You will own three surfaces that most companies split across several teams:
The platform - cloud infrastructure, security posture, and reliability for our core lending systems.
The fleet - the devices, identity, and corporate IT that every person at Skip depends on to do their best work.
The delivery pipeline - CI/CD, preview environments and deployment controls that let engineers and agents verify and ship changes many times a day, safely.
The thread connecting them is the same: make the secure, reliable path the automatic path. Least-privilege by default. Provisioning by code. Deployments that verify and gate themselves. Monitoring that tells us before customers do. Devices that configure, secure, and recover themselves. You measure your success not by how much you do, but by how much no longer needs doing.
The opportunity
We are a small, high-talent-density team scaling our business with compute and intelligence. The companies that win this phase keep their teams small and their leverage high - they do not hire linearly with growth. Security and reliability are usually where that breaks: they become a tax that grows with headcount. The opportunity here is to prove the opposite - that a single excellent platform engineer, building the right automation and guardrails, can let posture and reliability improve while the team stays lean. Engineering is changing the same way. With agents writing more of the code, the constraint has moved to verifying and deploying it. This role owns that side: the CI/CD pipeline, preview environments and risk-weighted deployment controls that let engineers and agents verify and ship their own changes safely, so the whole team ships more without growing headcount at the same rate.
Key Responsibilities:
Platform Security
Drive least-privilege everywhere: tightly scoped IAM roles, secrets management, network segmentation, and a credible answer to "who can touch what, and why."
Embed security as a design constraint across infrastructure and CI/CD — shift-left, not post-launch audit.
Establish and own our security posture trajectory: a credible path toward certification against best in class standards, whilst being fit-for-stage — not gold-plated theatre.
Lead vulnerability management, dependency and image scanning, penetration testing, and incident response.
Own our security findings SLA (critical within 1 business day, high within 2): tune our code scanning and penetration testing tools so they produce accurate signal, and monitor adherence.
Implement zero-trust access: internal tools isolated from the public internet and reachable only by verified staff on managed devices.
Uplift our AWS posture so a compromised credential can do little harm: scoped roles, short-lived credentials and no long-lived keys.
Automate security patching for dependencies and container images.
Monitor for unusual access and behaviour, and run a rehearsed incident response when something happens.
Run the security calendar (quarterly reviews, secret rotation, DR tests) and keep the evidence current, so audit, funder and regulatory questions can be answered quickly.
Reliability & Business Continuity
Own the reliability posture of Skip’s core lending platform: uptime targets, incident management, and a blameless post-mortem culture.
Define and test disaster recovery and business continuity — documented RPO/RTO targets, runbooks for failure at every layer, and regular game-days.
Infrastructure & Developer Experience
Own infrastructure-as-code and the deployment pipeline; make the path to production fast, safe, and boring.
Reduce friction for engineers so they continue to ship multiple times a day — architecture and tooling are velocity multipliers, not gatekeepers.
Remove the bottlenecks in how we build, test and deploy. With agents writing more of our code, the constraint is no longer writing code but verifying and deploying it, and you own both.
Give agents full, production-like preview environments to test against, so changes can be verified with increasing confidence.
Fleet, Identity & Corporate IT
Own corporate IT as an automated system, not a help desk: zero-touch device provisioning, MDM, endpoint security, and self-healing configuration across our fleet.
Automate onboarding and offboarding end-to-end — a new starter is fully, securely set up on day one without anyone manually clicking through it.
Own identity and access: SSO/MFA, lifecycle management, and access reviews that are evidenced and largely automated.
Build lightweight IT processes that scale from ~50 to 200+ people without bureaucratic drag.
Own device security alerts and quarantine through our MDM (Rippling).
Self-Securing, Self-Healing (where this role is going)
Progressively shift effort from doing security and reliability work to building the harness that does it — policy-as-code, automated remediation, and over time agent-assisted triage running inside deterministic guardrails you define and verify.
The north star: posture and uptime improve while the human effort per unit of scale falls. Self-securing does not mean unsupervised — you own the guardrails, and humans verify high-stakes changes.
In practice: agents run detection and access-anomaly response, patch dependencies and images, rotate secrets and assemble audit evidence, with you at the edges reviewing what matters.
What you will bring:
We’re looking for senior capability, expressed as autonomy and breadth more than years — but as a guide, this typically looks like 6+ years across DevOps, platform, security, or operations-heavy engineering, with the seniority to own outcomes end-to-end and set standards from scratch.
You have built and secured cloud infrastructure (AWS) in production, and you default to least-privilege, automation, and infrastructure-as-code — not manual administration.
You think in systems and harnesses: your instinct on seeing repeated toil is to automate it away, not to do it faster.
You have owned security posture and reliability somewhere real — and ideally have operated in a regulated or compliance-sensitive environment where security and velocity have to coexist.
You are comfortable owning the corporate IT and device-fleet surface, and you treat it as an automation problem (MDM, zero-touch, identity lifecycle) rather than a ticket queue.
You communicate trade-offs clearly, make pragmatic calls about what is fit-for-stage versus over-engineered, and you are happy being the founding owner who sets the standard others build on.
Bonus: experience with policy-as-code, detection-as-code, agentic/automated operations, or building self-healing systems.
Our stack (rough guide — you’ll shape where it goes): AWS, Serverless Framework, Auth0 for identity, BetterStack for observability, Doppler, Rippling MDM, Strix and Dam Secure. We care more about how you think than which of these you’ve used.
On requirements: we care far more about skills, approach, and the ability to learn than about specific certifications or a particular industry background. If you have strong cloud and security fundamentals and the instinct to automate, we want to hear from you — even if your résumé doesn’t tick every box above.