Founding Platform Engineer

📋 Job Overview

Skip is building the fastest, most intelligent home loan platform in Australia - on infrastructure that has to be both fast to iterate on and genuinely robust in a regulated lending environment. We are looking for a Founding Platform Engineer, our first dedicated platform and security hire. The job is to make sure our platform is secure, reliable, and observable by default - and to build it so that staying that way takes less human effort over time, not more. That includes how code reaches production: the CI/CD pipeline and deployment controls that let engineers and agents ship many times a day without trading off safety.

🏢 About Skip Loans

Skip is a high-talent-density team scaling their business with compute and intelligence. We are looking for a Founding Platform Engineer to help us build the fastest, most intelligent home loan platform in Australia.

🎯 The Role

Most "DevOps" job descriptions describe someone who runs infrastructure and fights fires. This role is about building the harness that runs the infrastructure - so security, reliability, provisioning and deployment increasingly enforce themselves. You will own three surfaces that most companies split across several teams: The platform - cloud infrastructure, security posture, and reliability for our core lending systems. The fleet - the devices, identity, and corporate IT that every person at Skip depends on to do their best work. The delivery pipeline - CI/CD, preview environments and deployment controls that let engineers and agents verify and ship changes many times a day, safely.

✅ Key Responsibilities

• Drive least-privilege everywhere: tightly scoped IAM roles, secrets management, network segmentation, and a credible answer to "who can touch what, and why."
• Embed security as a design constraint across infrastructure and CI/CD — shift-left, not post-launch audit.
• Establish and own our security posture trajectory: a credible path toward certification against best in class standards, whilst being fit-for-stage — not gold-plated theatre.
• Lead vulnerability management, dependency and image scanning, penetration testing, and incident response.
• Own our security findings SLA (critical within 1 business day, high within 2): tune our code scanning and penetration testing tools so they produce accurate signal, and monitor adherence.
• Implement zero-trust access: internal tools isolated from the public internet and reachable only by verified staff on managed devices.
• Uplift our AWS posture so a compromised credential can do little harm: scoped roles, short-lived credentials and no long-lived keys.
• Automate security patching for dependencies and container images.
• Monitor for unusual access and behaviour, and run a rehearsed incident response when something happens.
• Run the security calendar (quarterly reviews, secret rotation, DR tests) and keep the evidence current, so audit, funder and regulatory questions can be answered quickly.
• Own the reliability posture of Skip’s core lending platform: uptime targets, incident management, and a blameless post-mortem culture.
• Define and test disaster recovery and business continuity — documented RPO/RTO targets, runbooks for failure at every layer, and regular game-days.
• Own infrastructure-as-code and the deployment pipeline; make the path to production fast, safe, and boring.
• Reduce friction for engineers so they continue to ship multiple times a day — architecture and tooling are velocity multipliers, not gatekeepers.
• Remove the bottlenecks in how we build, test and deploy. With agents writing more of our code, the constraint is no longer writing code but verifying and deploying it, and you own both.
• Give agents full, production-like preview environments to test against, so changes can be verified with increasing confidence.
• Own corporate IT as an automated system, not a help desk: zero-touch device provisioning, MDM, endpoint security, and self-healing configuration across our fleet.
• Automate onboarding and offboarding end-to-end — a new starter is fully, securely set up on day one without anyone manually clicking through it.
• Own identity and access: SSO/MFA, lifecycle management, and access reviews that are evidenced and largely automated.
• Build lightweight IT processes that scale from ~50 to 200+ people without bureaucratic drag.
• Own device security alerts and quarantine through our MDM (Rippling).

🎁 Benefits

Competitive salary and benefits package.