Job description

About Us: webAI is pioneering the future of artificial intelligence by establishing the first distributed AI infrastructure dedicated to personalized AI. We recognize the evolving demands of a data-driven society for scalability and flexibility, and we firmly believe that the future of AI lies in distributed processing at the edge, bringing computation closer to the source of data generation. Our mission is to build a future where a company's valuable data and intellectual property remain entirely private, enabling the deployment of large-scale AI models directly on standard consumer hardware without compromising the information embedded within those models. We are developing an end-to-end platform that is secure, scalable, and fully under the control of our users, empowering enterprises with AI that understands their unique business. We are a team driven by truth, ownership, tenacity, and humility, and we seek individuals who resonate with these core values and are passionate about shaping the next generation of AI. About the Role: webAI runs private AI on the customer's own hardware: on-prem Apple-silicon fleets (some air-gapped), Linux servers, and the customer's own cloud. As Staff Platform/Infrastructure Engineer you'll own the substrate that makes this repeatable. That means how our kernel, services and local model inference get packaged, deployed, secured, observed and upgraded across bare metal and cloud. You'll inherit a production deployment serving a global enterprise customer, lead its move to a leaner next-generation architecture, and turn it into a deployment kit our forward-deployed engineers can use to install a new customer from the docs alone. This is a hands-on staff role: you'll make the architecture calls, write the code and carry the pager. What You'll Do: - Own deployment for the webAI kernel and B2B SDK. Deliver single-machine installs, multi-node clusters, and cloud (AWS, Azure/AKS) installs from one model, keeping the gap between cloud and bare metal small. - Choose and evolve our orchestration approach (Nomad, Kubernetes, or config-managed native services such as Ansible plus launchd) with simplicity as the goal. Cut custom infrastructure code where you can. - Run Apple-silicon fleets in production: launchd services, firewalling (pf), Lima/Docker VMs, GPU/unified-memory sizing for local LLM inference, and recovery after power loss or hardware failure. - Build the inference serving layer with the AI team: an OpenAI-compatible model gateway, conversation-pinned load balancing, routing per model and per persona, and performance/load testing (throughput, time to first token, concurrency). - Own the software supply chain: GitLab CI, container and OCI model artifacts, signing (cosign/minisign), pinned dependencies, mirrored registries for air-gapped sites, and the release process. - Secure the platform: secrets management (Vault, KMS, cloud secret stores), PKI and mTLS, enterprise identity integration (Entra ID/OIDC, SCIM), and network policy for on-prem sites. - Build observability and audit: metrics, logs and alerting (Prometheus, Loki, Grafana), plus export of audit and telemetry into customer monitoring tools. - Define what high availability means for us. Set reliability levels and SLOs we can commit to in customer contracts, then build them. - Write the runbooks, "recipes" and RCAs that let forward-deployed engineers and customers operate the stack without you. Lead incident response when they can't. - Work with kernel engineers on networking (QUIC/peer-to-peer connectivity, relays, NAT traversal) and on making the kernel easy to deploy. - Mentor engineers and raise the bar for infrastructure-as-code, testing and operations across the team. Requirements & Skills: - 8+ years building and operating production infrastructure. At least some of it on bare metal or on-prem, not only managed cloud. - Deep experience with at least one workload orchestrator (Nomad or Kubernetes), and the judgment to know when not to use one. - Strong Terraform and configuration management (Ansible or similar). Clean state and environment management across staging and production. - Production experience with AWS, Azure, or both (identity/IAM, KMS, container registries, managed Kubernetes). - Solid networking fundamentals: WireGuard/Tailscale or other VPN overlays, firewalls, NAT, load balancers and L4/L7 proxies (e.g. Envoy), DNS and TLS. - Secrets and identity: Vault or equivalent, PKI/mTLS, OIDC. - CI/CD and release engineering in GitLab: container builds, artifact signing, reproducible pinned builds. - Observability: Prometheus/Grafana/Loki or equivalent, alert design, running on-call. - Proficiency in at least one systems language (Rust or Go), plus scripting (Python/Bash). - Clear technical writing: runbooks, design docs and RCAs that others can act on. Nice to Have: - macOS fleet administration at scale (launchd, pf, MDM-managed or locked-down environments, FileVault constraints). - Running local LLM inference (llama.cpp, MLX, vLLM), GPU/unified-memory capacity planning, model packaging. - Air-gapped or disconnected delivery: mirrored registries, offline installers. - Peer-to-peer or QUIC networking (e.g. iroh, libp2p), relays and NAT traversal. - Writing Kubernetes operators/controllers or Nomad tooling (kube-rs, controller-runtime). - Customer-facing deployment experience: installing and supporting software at customer sites. We at webAI are committed to living out the core values we have put in place as the foundation on which we operate as a team. We seek individuals who exemplify the following: - Truth - Emphasizing transparency and honesty in every interaction and decision. - Ownership - Taking full responsibility for one's actions and decisions, demonstrating commitment to the success of our clients. - Tenacity - Persisting in the face of challenges and setbacks, continually striving for excellence and improvement. - Humility - Maintaining a respectful and learning-oriented mindset, acknowledging the strengths and contributions of others. Benefits: We strive to provide competitive benefits to all employees. The benefits listed in this posting generally apply to U.S.-based employees. For employees hired outside the United States, benefits may vary based on local law, country-specific requirements, and the employment platform or entity through which the employee is hired. - Competitive salary and performance-based incentives - Comprehensive health, dental, and vision benefits package - Including a high-deductible HSA option with company contribution - 401k match (US-based only) - Flexible PTO Policy - Parental leave for eligible employees - Continuing education support - Basic, company-paid life insurance - Supplemental life insurance - Company-paid short and long term disability - Free parking for in-office employees webAI is an Equal Opportunity Employer and does not discriminate against any employee or applicant on the basis of age, ancestry, color, family or medical care leave, gender identity or expression, genetic information, marital status, medical condition, national origin, physical or mental disability, protected veteran status, race, religion, sex (including pregnancy), sexual orientation, or any other characteristic protected by applicable laws, regulations and ordinances. We adhere to these principles in all aspects of employment, including recruitment, hiring, training, compensation, promotion, benefits, social and recreational programs, and discipline. In addition, it is the policy of webAI to provide reasonable accommodation to qualified employees who have protected disabilities to the extent required by applicable laws, regulations and ordinances where a particular employee works.

Requirements

Must-haves

Own deployment for the webAI kernel and B2B SDK. Deliver single-machine installs, multi-node clusters, and cloud (AWS, Azure/AKS) installs from one model, keeping the gap between cloud and bare metal small.
Choose and evolve our orchestration approach (Nomad, Kubernetes, or config-managed native services such as Ansible plus launchd) with simplicity as the goal. Cut custom infrastructure code where you can.
Run Apple-silicon fleets in production: launchd services, firewalling (pf), Lima/Docker VMs, GPU/unified-memory sizing for local LLM inference, and recovery after power loss or hardware failure.
Own the software supply chain: GitLab CI, container and OCI model artifacts, signing (cosign/minisign), pinned dependencies, mirrored registries for air-gapped sites, and the release process.
Secure the platform: secrets management (Vault, KMS, cloud secret stores), PKI and mTLS, enterprise identity integration (Entra ID/OIDC, SCIM), and network policy for on-prem sites.
Build observability and audit: metrics, logs and alerting (Prometheus, Loki, Grafana), plus export of audit and telemetry into customer monitoring tools.
Define what high availability means for us. Set reliability levels and SLOs we can commit to in customer contracts, then build them.
Write the runbooks, "recipes" and RCAs that let forward-deployed engineers and customers operate the stack without you. Lead incident response when they can't.
Work with kernel engineers on networking (QUIC/peer-to-peer connectivity, relays, NAT traversal) and on making the kernel easy to deploy.
Mentor engineers and raise the bar for infrastructure-as-code, testing and operations across the team.
8+ years building and operating production infrastructure. At least some of it on bare metal or on-prem, not only managed cloud.
Deep experience with at least one workload orchestrator (Nomad or Kubernetes), and the judgment to know when not to use one.
Strong Terraform and configuration management (Ansible or similar). Clean state and environment management across staging and production.

Nice-to-haves

macOS fleet administration at scale (launchd, pf, MDM-managed or locked-down environments, FileVault constraints).
Running local LLM inference (llama.cpp, MLX, vLLM), GPU/unified-memory capacity planning, model packaging.
Air-gapped or disconnected delivery: mirrored registries, offline installers.
Peer-to-peer or QUIC networking (e.g. iroh, libp2p), relays and NAT traversal.
Writing Kubernetes operators/controllers or Nomad tooling (kube-rs, controller-runtime).
Customer-facing deployment experience: installing and supporting software at customer sites.
We at webAI are committed to living out the core values we have put in place as the foundation on which we operate as a team. We seek individuals who exemplify the following:
Truth - Emphasizing transparency and honesty in every interaction and decision.
Ownership - Taking full responsibility for one's actions and decisions, demonstrating commitment to the success of our clients.
Tenacity - Persisting in the face of challenges and setbacks, continually striving for excellence and improvement.
Humility - Maintaining a respectful and learning-oriented mindset, acknowledging the strengths and contributions of others.

Application prep

Use the role’s language and application details while tailoring your materials.

Keywords to mirror

aiawsazurekubernetesdockerllmci/cdrustgopython

Platform: ashby
Effort: quick

Benefits

Benefits detected in the listing.

Dental

Vision

401k

Pto

Parental Leave