The posting
Mission:
Skip is building the fastest, most intelligent home loan platform in Australia - on infrastructure that has to be both fast to iterate on and genuinely robust in a regulated lending environment. We are looking for a Founding Platform Engineer, our first dedicated platform and security hire. The job is to make sure our platform is secure, reliable, and observable by default - and to build it so that staying that way takes less human effort over time, not more. That includes how code reaches production: the CI/CD pipeline and deployment controls that let engineers and agents ship many times a day without trading off safety.
About the role:
Most "DevOps" job descriptions describe someone who runs infrastructure and fights fires. This role is about building the harness that runs the infrastructure - so security, reliability, provisioning and deployment increasingly enforce themselves.
You will own three surfaces that most companies split across several teams:
- The platform - cloud infrastructure, security posture, and reliability for our core lending systems.
- The fleet - the devices, identity, and corporate IT that every person at Skip depends on to do their best work.
- The delivery pipeline - CI/CD, preview environments and deployment controls that let engineers and agents verify and ship changes many times a day, safely.
The thread connecting them is the same: make the secure, reliable path the automatic path. Least-privilege by default. Provisioning by code. Deployments that verify and gate themselves. Monitoring that tells us before customers do. Devices that configure, secure, and recover themselves. You measure your success not by how much you do, but by how much no longer needs doing.
The opportunity
We are a small, high-talent-density team scaling our business with compute and intelligence. The companies that win this phase keep their teams small and their leverage high - they do not hire linearly with growth. Security and reliability are usually where that breaks: they become a tax that grows with headcount. The opportunity here is to prove the opposite - that a single excellent platform engineer, building the right automation and guardrails, can let posture and reliability improve while the team stays lean. Engineering is changing the same way. With agents writing more of the code, the constraint has moved to verifying and deploying it. This role owns that side: the CI/CD pipeline, preview environments and risk-weighted deployment controls that let engineers and agents verify and ship their own changes safely, so the whole team ships more without growing headcount at the same rate.
Key Responsibilities:
Platform Security
- Drive least-privilege everywhere: tightly scoped IAM roles, secrets management, network segmentation, and a credible answer to "who can touch what, and why."
- Embed security as a design constraint across infrastructure and CI/CD — shift-left, not post-launch audit.
- Establish and own our security posture trajectory: a credible path toward certification against best in class standards, whilst being fit-for-stage — not gold-plated theatre.
- Lead vulnerability management, dependency and image scanning, penetration testing, and incident response.
- Own our security findings SLA (critical within 1 business day, high within 2): tune our code scanning and penetration testing tools so they produce accurate signal, and monitor adherence.
- Implement zero-trust access: internal tools isolated from the public internet and reachable only by verified staff on managed devices.
- Uplift our AWS posture so a compromised credential can do little harm: scoped roles, short-lived credentials and no long-lived keys.
- Automate security patching for dependencies and container images.
- Monitor for unusual access and behaviour, and run a rehearsed incident response when something happens.
- Run the security calendar (quarterly reviews, secret rotation, DR tests) and keep the evidence current, so audit, funder and regulatory questions can be answered quickly.
Reliability & Business Continuity
- Own the reliability posture of Skip’s core lending platform: uptime targets, incident management, and a blameless post-mortem culture.
- Define and test disaster recovery and business continuity — documented RPO/RTO targets, runbooks for failure at every layer, and regular game-days.
Infrastructure & Developer Experience
- Own infrastructure-as-code and the deployment pipeline; make the path to production fast, safe, and boring.
- Reduce friction for engineers so they continue to ship multiple times a day — architecture and tooling are velocity multipliers, not gatekeepers.
- Remove the bottlenecks in how we build, test and deploy. With agents writing more of our code, the constraint is no longer writing code but verifying and deploying it, and you own both.
- Give agents full, production-like preview environments to test against, so changes can be verified with increasing confidence.
Fleet, Identity & Corporate IT
- Own corporate IT as an automated system, not a help desk: zero-touch device provisioning, MDM, endpoint security, and self-healing configuration across our fleet.
- Automate onboarding and offboarding end-to-end — a new starter is fully, securely set up on day one without anyone manually clicking through it.
- Own identity and access: SSO/MFA, lifecycle management, and access reviews that are evidenced and largely automated.
- Build lightweight IT processes that scale from ~50 to 200+ people without bureaucratic drag.
- Own device security alerts and quarantine through our MDM (Rippling).
Self-Securing, Self-Healing (where this role is going)
- Progressively shift effort from doing security and reliability work to building the harness that does it — policy-as-code, automated remediation, and over time agent-assisted triage running inside deterministic guardrails you define and verify.
- The north star: posture and uptime improve while the human effort per unit of scale falls. Self-securing does not mean unsupervised — you own the guardrails, and humans verify high-stakes changes.
- In practice: agents run detection and access-anomaly response, patch dependencies and images, rotate secrets and assemble audit evidence, with you at the edges reviewing what matters.
What you will bring:
We’re looking for senior capability, expressed as autonomy and breadth more than years — but as a guide, this typically looks like 6+ years across DevOps, platform, security, or operations-heavy engineering, with the seniority to own outcomes end-to-end and set standards from scratch.
- You have built and secured cloud infrastructure (AWS) in production, and you default to least-privilege, automation, and infrastructure-as-code — not manual administration.
- You think in systems and harnesses: your instinct on seeing repeated toil is to automate it away, not to do it faster.
- You have owned security posture and reliability somewhere real — and ideally have operated in a regulated or compliance-sensitive environment where security and velocity have to coexist.
- You are comfortable owning the corporate IT and device-fleet surface, and you treat it as an automation problem (MDM, zero-touch, identity lifecycle) rather than a ticket queue.
- You communicate trade-offs clearly, make pragmatic calls about what is fit-for-stage versus over-engineered, and you are happy being the founding owner who sets the standard others build on.
- Bonus: experience with policy-as-code, detection-as-code, agentic/automated operations, or building self-healing systems.
Our stack (rough guide — you’ll shape where it goes): AWS, Serverless Framework, Auth0 for identity, BetterStack for observability, Doppler, Rippling MDM, Strix and Dam Secure. We care more about how you think than which of these you’ve used.
On requirements: we care far more about skills, approach, and the ability to learn than about specific certifications or a particular industry background. If you have strong cloud and security fundamentals and the instinct to automate, we want to hear from you — even if your résumé doesn’t tick every box above.
