Data Platform Engineer

AlterG Resources is developing next-generation geothermal technology to provide reliable, carbon-free baseload power. The Platform Engineer will own the identity, infrastructure, deployment, security, cost management, and operational platform supporting the company’s data and technology estate. This senior hands-on role will build self-service engineering workflows, infrastructure as code, CI/CD systems, monitoring, and access governance across Azure, Databricks, GitHub, and the MCP server.

Responsibilities:

• Design and own service principal and OIDC federated identity: the trust relationships, scopes, and token flows between Azure, GitHub Actions, and Databricks
• Define role-based access control across Unity Catalog, storage, applications, and repositories, as version-controlled code rather than portal configuration
• Own secret and token lifecycle, including scheduled rotation and the automation that keeps an expiring credential from becoming an outage
• Own the MCP server’s authorization model, including its Azure AD on-behalf-of token exchange, so every tool call runs with the calling user’s own Unity Catalog and SharePoint permissions. This is the most consequential thing you own: if its scope or token handling is wrong, one user can see another user’s data with no error to notice
• Run access governance as a standing practice: periodic review, least-privilege enforcement, and a documented joiner, mover, and leaver process
• Own production deploys for Databricks Asset Bundles, Azure App Services, and the MCP server
• Build infrastructure as code (Terraform or Bicep) for everything inside AlterG’s boundary, including configuration of provider-provisioned resources
• Administer the GitHub organization: branch protection, required checks, code owners, Actions policy, runners, and org-level secrets
• Design the CI/CD pipeline and the engineering standards built on it
• Build self-service environments and deploy paths so engineers can ship without waiting on the platform owner
• Deliver fast, trustworthy feedback: preview environments, meaningful checks, and short build times
• Design guardrails as defaults rather than gates, so the safe path is also the easy one
• Own monitoring, alerting, and application instrumentation
• Own cloud cost visibility and control, including Databricks compute cost and cluster policy
• Build runbooks and incident response so operational knowledge lives in systems, not individuals

Requirements:

• We assess experience by what you have built and operated, not by title or years
• Experience building infrastructure as code from scratch and living with it afterward
• Experience designing federated identity and token flows: service principals, scopes, delegated authorization (e.g., OAuth on-behalf-of), and scheduled secret rotation
• Experience designing a CI/CD system, not just maintaining one
• Experience governing a data platform's access model, in Unity Catalog or a comparable system
• Sound judgment about what to codify first rather than taking everything on at once
• Experience building with coding agents, with rigor about what is accept from them
• A track record of holding a technical line with fast-moving engineers by making the safer option the easier one
• Experience working productively across a managed service provider or shared platform boundary
• Azure preferred; depth from AWS or GCP transfers
• Azure: App Service, Key Vault, VNet and private endpoints, and Entra ID
• Databricks platform administration and Asset Bundles
• GitHub organization administration at scale, beyond repository-level work
• Small-company or early-platform experience setting standards rather than inheriting them
• Cost management on a growing cloud footprint
• Security or compliance work in a regulated or investor-facing environment
• Developer experience or internal platform work with named internal users