Decision Engineer Jobs in Colorado (NOW HIRING)

ABOUT THE ROLE

BlueAngle operates an Azure-based agentic operations platform and an internal Service Intelligence Platform that packages the firm's reusable capability modules. We are hiring an AI Engineer to own the secure infrastructure and delivery backbone beneath that platform, infrastructure-as-code, CI/CD, identity, and release automation. and to provide day-to-day technical mentorship to early-career engineers.

The role reports to the Platform & Technology Lead and works alongside the agentic engineering team. It exists to remove a single-point-of-bottleneck on the platform's secure, production-touching work and to let the team scale delivery without compromising governance.

SCOPE OF WORK

In scope. Azure infrastructure-as-code (Terraform) and workload provisioning; CI/CD pipeline engineering; identity and secrets (OIDC workload-identity federation, secret-store patterns, "zero long-lived keys"); the build-time pipeline that gates, packages, versions, and publishes the platform's reusable capability modules; integration server development; platform conventions, observability, and Architecture Decision Records.

Out of scope. Product roadmap and work-tracking ownership (held by the Lead); client-facing advisory delivery; authorship of capability-module content (enabled, not owned, by this role).

KEY RESPONSIBILITIES

• Own and extend the IaC and CI/CD foundation across platform repositories to a consistent house standard - resource naming, tagging, identity federation, serverless stack, secret management, observability, and branch protection.
• Provision new workloads end-to-end and bring them to a first secure deployment.
• Author and review Terraform, pipeline workflows, and service code; uphold pull-request discipline and protected branch policy.
• Design and operate the secrets-bearing and production-touching parts of the platform safely - federated credentials, release publishing, and key handling.
• Build integration servers (including Model Context Protocol servers) and register them with the platform gateway.
• Register platform components in the architecture catalog and keep specification, tracker, and repository in sync as the definition of done.
• Author Architecture Decision Records for non-trivial decisions and shepherd them to acceptance.
• Mentor and unblock early-career engineers; review their work and grow their scope over time.

CORE DELIVERABLES

Within the first engagement period, the role is expected to own and ship:

• The Azure foundation and CI/CD for the capability-module publishing pipeline — provisioning, identity federation, and release automation.
• Reusable build, review-gate, and publish workflows adopted by the platform's owning repositories.
• A scheduled reconciliation service that converges the published capability set into the managed workspace, with secure credential handling and a documented rotation policy.
• A steady cadence of reviewed integration servers delivered to the gateway.

REQUIRED QUALIFICATIONS

Essential

• Strong Azure: identity (Entra app registrations), serverless compute, key/secret stores, storage; OIDC / workload identity federation.
• Terraform (modules, remote state, multi-environment) and CI/CD pipeline engineering (reusable and composite workflows).
• Proficiency in Python and TypeScript; comfortable with shell/PowerShell for operational sequences.
• A security-first IaC mindset (least privilege, no long-lived secrets, auditable releases) and disciplined version-control practice.
• Clear technical writing (decision records, runbooks) and the temperament to mentor.

Desirable

• Experience with agentic platforms or LLM tooling; familiarity with the Model Context Protocol and the Anthropic Claude tooling ecosystem.
• API management, data-platform, and application-observability exposure.
• Managed-services or M&A-IT context.

WAYS OF WORKING & GOVERNANCE

The definition of done is a synchronized specification, work-tracker, and repository, plus passing quality gates and green CI. Non-trivial decisions are captured as accepted Architecture Decision Records before build. The role participates in a platform unblock/on call rotation as it forms.

ENGAGEMENT

• Type: Full-time, ongoing (a 3–6 month contract-to-hire is also acceptable).
• Location: Remote (US), hybrid optional.
• Hours: Standard business hours.

SUCCESS CRITERIA - FIRST 90 DAYS

• The capability-publishing pipeline's infrastructure and publish workflow are shipped and adopted by at least one owning repository.
• The scheduled reconciliation service runs with secure credential handling and a documented rotation policy.
• Early-career engineers' registration and packaging work reaches production without senior staff acting as a manual gate.
• All delivered work passes the definition-of-done; key decisions are captured as accepted decision records.