AI Platform Engineer

About the role

Zühlke is building a single knowledge base for the whole firm, accessible to colleagues and AI assistants through a governed access layer. As an AI Platform Engineer you build and run this platform, which includes an identity broker, an API gateway and an MCP composer that connects knowledge sources and, from 2027, business systems as MCP servers. Each request carries one token per person, narrowed at each boundary, and every call is audited.

Key responsibilities

• Build and operate the identity broker, gateway and MCP composer on Azure Kubernetes Service.
• Implement OAuth 2.0 and OIDC flows with Keycloak, federated to Entra ID, including token exchange (RFC 8693) and per-source permissions.
• Connect new knowledge sources and business systems as MCP servers and help their teams onboard them.
• Build semantic search and indexing on PostgreSQL with pgvector, and improve ranking over skills, experiences and documents.
• Secure the MCP layer against tool poisoning and toxic flows, and control token cost with budgets and rate limits per client.
• Run everything as code: infrastructure in Bicep, deployments via GitLab CI and Argo CD, realm configuration and access policies in Git.
• Own production readiness with security and operations: audit, monitoring, load tests and autoscaling, and reduce single-operator risk by documenting and sharing operations knowledge.

Required profile

• At least five years of professional software engineering, including running production services on a cloud platform.
• Strong Java and Spring skills; Spring Cloud Gateway experience is a plus.
• Hands-on experience with Kubernetes and Azure (AKS, PostgreSQL, Key Vault, Front Door, Container Registry).
• Experience with search and retrieval, such as embeddings, pgvector or similar vector search.
• Observability and testing practice, such as Application Insights, LLM tracing with Langfuse or similar, and load tests with k6 or similar.
• Good communication skills, confident English and ability to work in an international environment.

Required skills

• Solid knowledge of OAuth 2.0 and OIDC, ideally with Keycloak and Entra ID; token exchange experience is a strong plus.
• Infrastructure as code and GitOps, for example Bicep, GitLab CI and Argo CD.
• Familiarity with the Model Context Protocol (MCP) and its security risks, such as tool poisoning.
• Plus: agent frameworks such as Claude Agent SDK, Azure AI Foundry or LangGraph, and working knowledge of responsible AI and AI governance such as the EU AI Act.