Cloud / Platform Engineer (Kubernetes, GCP, AWS)

Why this role exists

We deploy other people’s applications on demand: a generated app becomes a live URL, on our infrastructure or inside the customer’s own AWS or GCP account. That is an infrastructure product hiding inside an application platform. It works, it is in production, and it has more shell script and less automation in it than a system this important should have. You would own it, and the mandate is to make it boring.

On call, honestly

There is no formal rotation today — today it is the founders and whoever last touched the thing. Building a real one, with a defined escalation path, alerts that mean something, and a rotation that includes engineers who are not you, is part of this job rather than something you inherit alone. We are not hiring one person to be the pager.

What you’ll own

• The Kubernetes platform. A high-availability control plane, our own registry, deployment topology, and the rendered manifests behind it.
• Multi-cloud deploy paths. GCP (Cloud Run, Cloud Build, GCS) and AWS (CodeBuild, ECR, App Runner/ECS). On GCP we deploy into the customer’s own project by impersonating a service account, with a confused-deputy guard that fails closed — no keys are ever created or stored. On AWS we still use a customer-issued IAM access key. Closing that gap is real, scoped work waiting for you.
• Preview and live environments. Ephemeral previews and long-lived production apps, which we separated properly after learning the hard way that they must not share a lifecycle. The open piece is that “is this app live?” still has two disjoint sources of truth — a backend record and five fields the browser writes — and no teardown path reconciles them. That one is yours.
• CI/CD and release. Build, image promotion, rollout, rollback — and making “which version is actually running in that pod” a five-second question.
• Observability and cost. Logs a human can find, alerts that mean something, and a cloud bill that scales with customers rather than with mistakes.
• Security posture. Secrets, network policy, TLS, CSP and CORS on served applications, and the tenant boundary at the infrastructure layer.

What we look for

• 4+ years in cloud infrastructure, platform engineering or SRE, running production.
• Kubernetes past the tutorial — you have debugged a cluster at 2am and can explain what you found.
• AWS and/or GCP at depth, IAM included. Especially IAM.
• Infrastructure as code, plus fluency in the shell and Python glue that real platforms are actually made of.
• CI/CD ownership and a bias toward making deploys boring.

Nice to have

Multi-tenant infrastructure. Cost engineering. Terraform. Datadog or equivalent. Having run someone else’s workload safely. Experience shipping software into someone else’s data centre — on-prem is single-VM today and the lanes beyond that are unbuilt, so that experience is worth a lot here.

Build something on Supero and skip our take-home entirely

The most reliable signal we have ever had about a candidate is an application they built. So we made it the front door. Build a small system on Supero — over MCP from your own AI editor — and send us the link: it shows us you understand the platform far better than a résumé line can. Aim for 90 minutes, and note there are two equally valid ways to satisfy this, listed below.

• Bring your own idea, and scope it small. We build tooling that generates full-stack apps — it would be strange to ask you to interview without it. So bring your own idea, use whatever gets you there, and be ready to explain every decision inside it. Model something you actually know: a domain you have worked in, or a system that annoyed you. Three to five entities, two roles, one thing that can go wrong. Aim for 90 minutes; four hours is the hard cap.
• Turn multi-tenancy on when you generate — and notice that you had to. It is a generation-time flag, it defaults to off, and it is expensive to retrofit. We think that default is wrong. It is the same shape of problem we criticise elsewhere — opt-in per thing, someone has to remember, painful to add later — and it is on the list to change. We are telling you because you will hit it, because we would rather you hit it knowingly, and because what you would do about it is a question we would genuinely like your answer to. Meanwhile: switch it on, because we do look at whether your model survives a second tenant.
• Send a screenshot, the link, and your read on us. A screenshot of your application’s landing page is the one thing we always want — a running app can go down, and the screenshot survives. Send the live URL too, and optionally push the source to your own GitHub and send that link. Then a few paragraphs: what you were modelling, one decision you reversed, and two things about Supero itself — what you liked most, and what you would improve. That last one is not a courtesy question. What you notice tells us how you think, and we act on it.
• What you get back. A person reads every submission — not an auto-responder, and not a keyword screen. If it moves forward, an engineer writes back with what they saw in your model. And a completed build replaces our screening call and our take-home entirely: you go straight to a technical conversation with the people you would work with.

Two ways to satisfy this — they are scored the same

• Build it over MCP — the one we prefer. Point Claude Code, Cursor or Copilot at Supero’s MCP server and drive the whole build from your own editor. This is the route we would rather you took: it is how the platform is meant to be used, it is the closest thing to the actual job, and it tells us the most about how you think. App Studio exists and works, but MCP is what we are looking for here.
• Send something you already built. Any stack, any age, any domain — plus one page on the data model and the decision you would now reverse. Scored exactly the same way. Nothing about this route is a lesser option.

Start with MCP →Create an account for your key →

The fine print

• You own what you build. Full intellectual property and copyright stay yours, and our platform terms do not override that. We receive only a limited licence to review your submission as part of your application.
• Do not submit anything that is not yours to submit. No current or former employer’s confidential information, proprietary code or data. No real personal data belonging to anyone, including yourself. Invent your test data. If a contract restricts outside development, tell us and take route 2 or 3 instead.
• Time-box it. Aim for 90 minutes and do not exceed four hours. We mean it: a submission built in 90 minutes is scored exactly like one someone spent a fortnight on, and the small sharp one usually wins. Spending longer does not help you.
• What happens to your data. The account you create stays yours. We delete our copy of your submission, and any repository access you granted, within 90 days of a final decision — or sooner if you ask. Write to [email protected] at any time.
• A human scores every submission. No automated screening decides whether you move forward.
• Where the line is on breaking things. Inside your own project — including across tenants you created yourself — break whatever you like. Probe the tenant boundary, try to read a field your second role should not see, send the state transition that should be rejected. That is the exercise, and telling us what you found is one of the things we score. Outside your own project — other people’s accounts, our infrastructure, our authentication, anything you were not given — please stop. No scanners. If you find something that reaches beyond your own project, do not keep pulling: write to [email protected] and we will thank you properly. Reporting in good faith is never held against you.
• What the account gives you. No credit card. A challenge account carries an allowance sized well above what this exercise needs — if you genuinely run out mid-build, write to us and we will top it up. Your submitted URL stays live for at least 30 days.
• No obligation either way. Doing this is not a condition of being considered, and we are not obliged to hire or pay for any submission.

How this goes

Every step, stated up front, so you can decide whether to start it. No fixed timeline — we go as fast or as slow as it takes to be sure, in both directions.

• STEP 1 — You apply. A person reads it. No keyword screen. If you did the build challenge, that is what we read first.
• STEP 2 — 30-minute conversation. With the person who would be your manager, about what you have built. Skipped entirely if you submitted a build.
• STEP 3 — 90-minute technical session. A real problem from our backlog, or a walkthrough of your build. No algorithm puzzles and no whiteboard trivia.
• STEP 4 — Two 45-minute conversations. With people you would work with. One is a design-review simulation, which is the closest thing to the actual job.
• STEP 5 — Founder conversation, then offer. We tell you where you stand after every stage, including when the answer is no.

Find us

• GitHub. github.com/supero-platform/supero-apps — Example applications built on Supero.
• LinkedIn. www.linkedin.com/company/supero-dev/ — Company updates and the people here.
• Docs. docs.supero.dev — The platform, in full technical detail.

Equal opportunity

Supero is an equal opportunity employer. We consider all applicants based on their qualifications, skills, and experience, without regard to race, color, religion, caste, sex, pregnancy, sexual orientation, gender identity or expression, national origin, citizenship or immigration status, age, disability, medical condition, marital or family status, veteran status, or any other characteristic protected by applicable law.

We maintain an Equal Opportunity Policy and designate a Liaison Officer in accordance with the Rights of Persons with Disabilities Act, 2016. We also maintain an Internal Committee in accordance with the Sexual Harassment of Women at Workplace (Prevention, Prohibition and Redressal) Act, 2013.