资深AI平台工程师
Staff AI Platform Engineer
在Sysdig，我们相信云安全不是一种妥协，而是一种承诺。从一开始，我们的使命就很明确：帮助组织以正确的方式保障云中的创新。
我们创建了Falco，这是云威胁检测的开源标准，并继续通过运行时洞察、开放创新和代理AI引领云安全市场。由超过60%的财富500强企业信任的技术创造者，Sysdig为团队提供实时的清晰度，让他们快速行动并保护最重要的东西。
文化在这里至关重要。我们认为多样性能激发更强大的想法，开放对话能推动更精准的决策。连续五年被列为最佳工作场所之一，并入选德勤最快成长公司，我们致力于提升云安全和职场文化的标杆。
如果你有深入探索的热情，有挑战传统愿望，以及有构建更好的事物的好奇心，那么Sysdig就是适合你的地方。
你将负责
推动业务端的Bedrock运行时和网关配置——模型访问、成本归因、内容过滤防护措施、模型固定和配额管理，通过AWS/Okta-SSO网关实现——与我们的DevX负责人共同负责，该负责人主导共享基础架构架构。
构建并运行MCP集群——为业务应用和数据库部署、保障安全并打补丁自托管和托管的MCP服务器，并负责MCP注册表。与IT合作，将MCP升级为稳定、由IT管理的资产。
让安全路径成为便捷路径，无需自行管理身份或设备：编写MDM配置负载和Okta组到IAM的映射，由IT推送并强制执行，并指定非技术员工的桌面客户端设置和认证流程。
构建AI和代理触发的自动化（审批、支出警报、代理发起的工作流）；通用业务自动化仍由IT负责。
负责其他团队基于其上的代理托管基础架构的技术方向——设计文档和标准，而不仅仅是代码。目前没有现成的模式；你将制定它，其他团队会将其作为默认方案采用。
定义平台上每个代理和MCP服务器的“健康”和“可发布”标准——成本、使用情况和可靠性遥测（Bedrock到Snowflake的管道，身份匹配，带阈值警报），以及分层自主模型：哪些保持只读，哪些可以执行，哪些需要人工介入或回滚路径。
构建治理机制，满足标准要求。按工作流路由
查看英文原文
At Sysdig, we believe cloud security isn't a compromise - it's a promise. From the start, our mission has been clear: to help organizations secure innovation in the cloud, the right way.
We created Falco, the open standard for cloud threat detection, and continue to lead the cloud security market with runtime insights, open innovation, and agentic Al. Creators of technology trusted by over 60% of the Fortune 500, Sysdig gives teams the real-time clarity to move fast and defend what matters most.
Culture matters here. We believe diversity fuels stronger ideas, and open dialogue drives sharper decisions. Recognized as a Best Place to Work and one of Deloitte's fastest-growing companies for the past 5 years, we're here to raise the standard for what cloud security and workplace culture should be.
If you have the passion to dig deeper, the desire to challenge convention, and the curiosity to build something better, Sysdig is the right place for you.
What you will do
Drive the business-side Bedrock runtime and gateway configuration - model access, cost attribution, content-filtering guardrails, model pinning, and quota management, behind an AWS/Okta-SSO'd gateway - co-owned with our DevX lead, who leads the shared-substrate architecture.
Build and run the MCP fleet - ship, secure, and patch self-hosted and managed MCP servers for business apps and databases, and own the MCP registry. Partner with IT to graduate MCPs into stable, IT-managed assets.
Make the secure path the easy path without administering identity or devices yourself: author the MDM config payload and the Okta-group-to-IAM mapping that IT pushes and enforces, and specify the desktop client setup and auth flows for non-technical employees.
Build the AI and agent-triggered automations (approvals, spend alerts, agent-initiated workflows); general business automation stays with IT.
Own the technical direction for the agent-hosting substrate other teams build on - the design docs and standards, not just the code. There is no existing pattern today; you set it, and other teams adopt it as their default.
Define what "healthy" and "safe to ship" mean for every agent and MCP server on the platform - the cost, usage, and reliability telemetry (the Bedrock-to-Snowflake pipeline, identity-matched, with threshold alerting), plus a tiered-autonomy model: what stays read-only, what can act, what needs a human in the loop or a rollback path.
Build the governance that standard requires. Route workflows by data sensitivity, enforce least privilege and auditability, and keep unproven models sandboxed away from production data.
Drive alignment across IT, Security, and DevX on the platform's direction - get multiple teams building against a written standard without owning their roadmaps.
What you will bring with you
6+ years in software engineering, platform engineering, or DevOps, including ownership of something in production that others depended on.
Hands-on AWS - IAM, ECS or Lambda, CloudWatch, and working VPC knowledge. Required, not a bonus.
Full-stack range - backend services, APIs, CI/CD, containerized deployments.
Builder - you can write an MCP server or API integration from scratch, not just wire up a managed connector.
Hands-on with LLMs - comfortable with LLM APIs, prompt engineering, and agent development; you've shipped something with them.
Self-direction - you can take an underspecified task and figure out the ambiguous parts to create impactful solutions.
What we look for
A bias to ship, and to automate the thing you just did by hand.
Willingness to own the boring parts: upgrades, credentials, quotas, on-call reality.
Candor: you raise problems and disagreements early, including when a platform choice looks wrong.
Judgment about when to buy instead of build. We would rather run a small, coherent stack than a perfect, sprawling one.
When you join Sysdig, you can expect
Extra days off to prioritize your well-being
401(k) Retirement Savings Plan with a 3% company match
Maternity and Parental Leave
Mental health support for you and your family through the Modern Health app
Full health benefits package for you and your family
The U.S. annual salary range for this full-time position is between 123,000 and 154,000 USD/year. Actual offers may be higher or lower than this range based on a variety of factors, including your work location, job-related experience and education.
We would love for you to join us! Please reach out even if your experience doesn't perfectly match the job description. We can always explore other options after starting the conversation. Your background and passion will set you apart, especially if your career path is different.
Sysdig values a diverse workplace and encourages women, people of color, LGBTQIA+ individuals, people with disabilities, members of ethnic minorities, foreign-born residents, and veterans to apply. Sysdig is an equal-opportunity employer. Sysdig does not discriminate on the basis of race, color, religion, sex, national origin, age, disability, genetic information, sexual orientation, gender identity, or any other legally protected status.
#LI-MC1
#LI-Remote