Senior IT & AI Systems Engineer

CloudZero is making a foundational hire in the Office of the CTO: the person who builds the data and AI platform the rest of the company operates on.

Almost everything a team needs, whether it is the pipeline number, the churn signal, or the answer an agent gives a CS rep at 4pm, depends on data that today lives across dozens of SaaS systems and is moved by hand. You'll build the layer that ends that: governed pipelines into Snowflake, a modeled surface analysts and agents can query without guessing at joins, and the environments where agents run with real identity and real cost attribution.

You'll also own the systems underneath it, including Okta, Jamf, Google Workspace, Slack, Jira, and Ravenna, because they're the identity and event substrate that the platform inherits. The Okta group that provisions a new hire's laptop is the same group that determines what an agent can access when that person invokes it. Whoever owns one should own both.

Hybrid out of our Boston office. Some flexibility outside East Coast hours helps, since our employees and customers are global.

Automation first. Manual work last.

Manual work shows up in two shapes here, and they're the same problem:

• A ticket is a signal that a system failed a person. Ask why the question came up at all, and fix the upstream cause so the next ten people don't hit the same wall.

• A repeated request for a number is a data product that doesn't exist yet. The third time someone pulls the same figure by hand, that's not a favor to do, it's a table you haven't modeled.

The queue and the query log are both data. Instrument them, group by root cause, and let the pattern drive your roadmap.

• You reach for Claude Code, Claude Desktop, or Cursor before problem-solving manually, whether that's drafting transformations, parsing logs, reasoning about a schema you've never seen, or breaking apart messy projects.

• You can talk credibly about which models and tools are good at what, where they fall short, and how to prompt them well.

• You try new tools as they show up, and drop them when they don't earn their keep.

If writing a prompt is your default move when something looks unfamiliar, you'll fit in.

The data platform

• Ingestion from our SaaS estate and cloud billing sources. CDC and ELT out of Salesforce/HubSpot, Jira, Okta, Ravenna, UKG, and support tooling, with schema drift handled and backfills that are boring.

• The modeled warehouse: conformed dimensions, tested transformations, and a semantic layer where "ARR" resolves to one number regardless of who asks.

• Data quality as a product concern: freshness SLAs, drift alerting, lineage. When a pipeline breaks silently, an agent confidently gives a VP the wrong answer.

• Governance in the warehouse itself: Snowflake RBAC, row- and column-level policy, and masking mapped to Okta groups, so access is inherited from identity rather than granted by ticket.

• Cost visibility per team, per workload, per agent. We sell cost intelligence. Ours should be exemplary.

• Data products other teams run on: Marketing attribution, Finance close support, Sales pipeline, and CS health, built as self-serve surfaces rather than a request queue routed through you.

• The retrieval layer agents depend on: chunking strategy, embedding pipelines, index freshness, and evaluation of retrieval quality. A stale index is a wrong answer with confidence.

• The identity-inheritance model, so an agent invoked by a CS rep or a finance analyst operates with exactly the permissions they have across AWS, Snowflake, and SaaS. Never more. No shared service accounts.

• AI Landing Zones across AWS, GCP, Azure, and Snowflake: governed, self-service environments where any department can deploy agents safely without being cloud engineers.

• The developer experience for internal agent builders: templates, deploy paths, docs, and office hours that turn one team's work into every team's capability.

The systems underneath

• The core IT platform (Okta, Jamf, Google Workspace, Slack, Jira, Ravenna) run as a product with a roadmap and a shrinking manual surface.

• Employee lifecycle automated end-to-end: joiners, movers, and leavers driven by HRIS as the source of truth, with no human in the loop.

• The cloud perimeter: account structure, SCPs, IAM, and network segmentation for our major cloud providers (AWS, Azure, Snowflake), plus a Security partnership where new tooling is safe by default rather than safe by review.

• Every system of record lands in Snowflake on a schedule people trust, with alerting that catches a break before a stakeholder does.

• A modeled, documented core layer exists, and the first three teams outside Engineering answer their own questions against it.

• Warehouse access is inherited from Okta groups rather than granted by request.

• One agent is in production against that layer, running with its invoker's permissions, with its cost attributed to a team.

• 7+ years at the intersection of data engineering and infrastructure. You've built pipelines and the platforms they run on, and been on call for both.

• Working Snowflake experience, or a comparable warehouse you've built pipelines into and governed. Familiarity with its RBAC, policy, and cost model, or a clear track record of picking that up on a new platform.

• Comfortable with orchestration (Airflow, Dagster, Prefect, or equivalent) and opinions about idempotency, backfills, and late-arriving data. Transformation tooling like dbt is a plus, not a prerequisite.

• Strong software engineering fundamentals. Python required, SQL assumed, Go or Bash a plus. IaC at scale (Pulumi, CDK, CloudFormation) where you set the standard rather than follow it.

• Hands-on production AI and LLM experience with agents, RAG, tool-calling, and MCP or equivalent, plus a point of view on agent identity, tool governance, and what breaks once it's live.

• Deep AWS (Bedrock, IAM, EventBridge, Lambda) with working knowledge of GCP and Azure. Strong API instincts: you've stitched SaaS systems together with REST, webhooks, and event hooks, and know where those integrations rot.

• Working command of the IT toolkit: Okta SSO and Workflows, Jamf including packaging, Google Workspace, and Jira, plus experience automating employee lifecycle against an HRIS.

• A root-cause mindset and a bias for shipping. You're exceptional with people. This role sits close to every team, and how you make someone feel matters.

• Streaming or event-driven data experience (Kafka, Kinesis, Snowpipe)

• Data observability and lineage tooling in production

• Experience evaluating retrieval quality, where you measured whether RAG actually worked rather than just shipping it

• Practical familiarity with SOC 2 or ISO 27001

• Examples of agents, pipelines, or automations that retired a recurring class of work

About CloudZero
CloudZero is the AI ROI Company. We built the financial control plane for AI: the system finance, IT, and engineering use to connect every AI dollar to the outcome it produced. Across every provider. In real time.
AI spend is the fastest-growing line on enterprise P&Ls and the least understood. Only 14% of CFOs can prove AI ROI today. CloudZero answers the question no one else can: what did it cost to produce this outcome, for this customer, on this model.
The largest cloud spenders on the planet already run on CloudZero, including Coinbase, Duolingo, DoorDash, and Shutterstock. We processed 14 trillion billing events in the last twelve months. We're the first listed partner on Anthropic's cost and usage API. We've raised over $119 million, including a $56 million Series C backed by leading venture capital firms.

Why Join Our Team?
At CloudZero, you’ll find a collaborative, fast-moving environment where your work makes a direct impact. We’re a team that values ownership, creativity, and curiosity — and we’re tackling some of the most complex challenges in the cloud space. If you’re excited by working with cutting-edge technology, driving meaningful outcomes, and growing with a company that’s scaling fast, we’d love to hear from you!