Senior Cloud Engineer - SC Cleared

Senior GCP Cloud Engineer (Contract, SC) - Kubernetes / GKE / Air-Gapped

THE SHORT VERSION
A UK technology business building AI systems for regulated, security-sensitive environments is standing up a new data platform on Google Cloud, and needs someone to own the ground it runs on. GKE, infrastructure as code, CI/CD and observability, on a deliberately open-source stack with no managed-service shortcuts. You run it yourself rather than consuming managed equivalents. The interesting part is the topology: an edge cluster and a central cluster with replication between them, putting real weight on networking, inter-cluster connectivity and security posture.

This is a GCP role end to end. If your depth is in Azure or AWS, this one won''t be the right fit.

THE ENGINEERING PROBLEM

• Split topology. An edge cluster and a central cluster with replication between them. Getting that right is the defining challenge of the role.
• Constrained environments. Deployments into restricted, disconnected and high-classification networks, which changes almost every assumption you can normally make about connectivity and tooling.
• Security by design. Systems are under accreditation scrutiny, so hardening, network policy, secrets management and identity are design inputs rather than afterthoughts.

WHERE YOU WOULD BE WORKING
A venture-backed UK scale-up building AI platforms for highly regulated and security-sensitive sectors, delivering across high-profile government and commercial programmes. Delivery-driven, highly autonomous engineering with small teams given real ownership. We are keeping the client name off this document; get in touch and we will tell you exactly who it is before you decide anything.

WHAT THE JOB INVOLVES

• Design, build and operate secure, resilient infrastructure on Google Cloud for regulated and air-gapped environments.
• Build and maintain Kubernetes clusters on GKE, including the split edge and central topology and the replication between them.
• Own infrastructure as code, CI/CD pipelines and automated, repeatable deployments.
• Implement observability, monitoring, alerting and incident response across distributed clusters using Prometheus, Grafana and Loki.
• Harden systems and embed the security controls needed for accreditation, covering network policy, secrets management and identity, and support deployments into restricted, disconnected and high-classification networks.

WHAT YOU WILL NEED

• Strong Google Cloud experience, GKE in particular. This is the core of the role, not a nice-to-have.
• Deep experience with containers and orchestration, Docker and Kubernetes, alongside strong Linux systems administration.
• Proven track record standing up and running production cloud infrastructure as a cloud, DevOps or SRE engineer.
• Infrastructure as code, whether Terraform, Ansible or equivalent, and CI/CD tooling such as GitLab CI, GitHub Actions or Jenkins.
• A solid understanding of secure, hardened deployments and network security, with instincts suited to an environment under accreditation scrutiny.
• SC clearance. Active clearance is strongly preferred for this contract; for the right person, genuine eligibility will be considered.

WHAT WOULD HELP

• Air-gapped, on-premise or restricted-network deployments, and multi-cluster or geographically distributed architectures.
• Kubernetes networking and policy tooling such as Cilium and eBPF, and event streaming infrastructure, Kafka, ideally via Strimzi.
• Secrets management, PKI and identity using Vault or Keycloak; scripting in Python, Bash or Go; and a defence, government or regulated sector background.

CONTRACT TERMS AND CLEARANCE

• £400 to £500 per day, depending on experience and clearance status. Active SC sits at the top of that range.
• Remote across the UK, with occasional travel as the programme requires. Duration and IR35 status confirmed on application.
• Read this carefully. SC eligibility requires a provable five-year UK address history. If you have lived outside the UK within that window, this will be difficult on this programme''s timeline. A DBS check or BPSS clearance is not the same as SC.

For a confidential conversation and the client name, email (url removed)