What you’ll do
Own infrastructure as code for the boundary: Define the architecture, module standards, and delivery workflow for all FedRAMP infrastructure in Terraform (or similar), and drive the platform toward fully codified, reviewed, and automatically deployed infrastructure.
Design provisioning and organization: Architect how cloud accounts, organizational units, networks, Kubernetes clusters, and environments are structured and provisioned inside the authorization boundary, including landing zones, guardrails, and account vending, so that new workloads land compliant by default.
Build the provisioning platform: Write production software (Go, Python, or TypeScript) for the controllers, pipelines, and internal tooling that turn infrastructure requests into reviewed, policy-checked, automatically applied changes.
Apply AI to infrastructure: Use AI-assisted development tooling daily, and build AI-driven automation into the platform: agents that draft and validate IaC changes against policy, generate compliance evidence from infrastructure state, and detect and remediate drift.
Set technical direction: Own the multi-year platform architecture, write and review design documents, make build-versus-buy decisions, and align engineering, security, and compliance stakeholders on the roadmap.
Engineer for compliance: Translate FedRAMP controls (NIST SP 800-53) for configuration management, change control, and boundary protection into policy-as-code and automated evidence, and partner with security on continuous monitoring (ConMon) and annual assessment readiness.
Run the platform like an SRE: Establish reliability standards, SLOs, and incident practices for the provisioning layer, and lead the response when the foundation itself has problems.
Lead and multiply: Mentor Staff and Senior engineers, lead cross-team migrations onto the standard platform, and act as the final technical authority for infrastructure decisions inside the boundary.
What we’re looking for
Experience: 12+ years of software, infrastructure, or site reliability engineering experience, including at least 3 years operating within a FedRAMP-authorized or similarly regulated environment, with hands-on AWS GovCloud experience.
Infrastructure as code mastery: Deep, hands-on expertise designing and scaling Terraform (or similar) across many accounts and environments: module design, state management, policy-as-code (e.g., OPA, Sentinel, Checkov), and GitOps-based delivery.
Cloud organization and provisioning: Proven experience designing multi-account cloud organizations, landing zones, account vending, network topology, and IAM boundaries at scale, and an understanding of how those choices map to compliance controls.
Software engineering proficiency: Strong programming fundamentals and a track record of shipping production software in Go, Python, or TypeScript, including internal platforms and developer tooling used by other engineers.
Kubernetes expertise: Extensive experience architecting, provisioning, and hardening Kubernetes clusters as code, including policy enforcement (e.g., OPA/Gatekeeper, Kyverno) and secrets management.
Technical leadership: A history of setting architecture direction for a platform organization, writing design documents that others build from, and influencing without authority across engineering, security, and compliance.
SRE practice: Experience owning reliability for foundational infrastructure, including incident command, postmortems, and systematic toil reduction.
AI tooling: Comfort using AI-assisted development tools in daily work, and a point of view on how AI should be applied to infrastructure automation.
Nice to Have
Experience with cloud traffic, service mesh, and observability tooling (Istio, Kong, Cloudflare, Datadog).
Experience with IAM architecture (Okta, SAML/OIDC, zero-trust) and FIPS 140-2/140-3 validated cryptography in practice.
Experience with secrets management platforms operating in FIPS mode (e.g., HashiCorp Vault).
Familiarity with FedRAMP Rev 5 requirements, STIG application, or CIS benchmark enforcement at scale.
Experience building AI agents or ML-driven automation for infrastructure (AIOps).
Certifications such as HashiCorp Terraform Authoring and Operations Professional, AWS Solutions Architect - Professional, CKA/CKS, or CISSP.
Additional Information
Base Pay Range
198,240.00 - 272,580.00 USD Annual
This role may also be eligible for Equity Compensation and/or Bonus Incentive Compensation. Procore is committed to offering competitive, fair, and commensurate compensation. Actual compensation will be based on a candidate’s job-related skills, experience, education or training, and location.
This position requires access to technology, software, and data that is controlled or restricted under U.S. law, regulation, executive order, or government contract.
For Los Angeles County (unincorporated) Candidates
Procore will consider for employment all qualified applicants, including those with arrest or conviction records, in accordance with the requirements of applicable federal, state, and local laws, including the City of Los Angeles’ Fair Chance Initiative for Hiring Ordinance, the Los Angeles County Fair Chance Ordinance for Employers, and the California Fair Chance Act.
A criminal history may have a direct, adverse, and negative relationship on the following job duties, potentially resulting in the withdrawal of the conditional offer of employment: 1. appropriately managing, accessing, and handling confidential information including proprietary and trade secret information, as well as accessing Procore's information technology systems and platforms; 2. interacting with and occasionally having unsupervised contact with internal/external customers, stakeholders, and/or colleagues; and 3. exercising sound judgment.
