Lead Infrastructure Engineer - Remote - Contract

About the job
Lead Infrastructure Engineer - Remote - Contract
Cloud, Zero Trust & Platform Infrastructure

Location
Remote – United States

Company
AlareLeadership Inc. alare.com

Role type
Early-stage / contractor technical leadership role

Progression
Potential Chief Technology Officer (CTO) as the company grows and scales (non-binding)
The RoleAlareLeadership Inc. is building the technology foundation required to support a remote-first organization and the global delivery of the Alarè Platform. We are looking for an experienced Lead Infrastructure Engineer to own Alare's corporate infrastructure, cloud foundation, Zero Trust architecture and infrastructure engineering capability, taking the existing HLA through detailed design, implementation, testing, operational handover and continuous improvement.The target environment combines AWS, Microsoft cloud services and open-source technologies, with a deliberate preference for open-source solutions where they provide an appropriate level of security, supportability and operational resilience. This is a senior hands-on architecture and engineering position: the successful candidate should be comfortable designing the solution, writing Infrastructure as Code, implementing components, and troubleshooting the resulting environment.

Scope Boundary
This role owns the technology infrastructure on which AlareLeadership Inc. operates, and the Alarè Platform runs. It does not own the software architecture or application development of the Alarè Platform.

Lead Infrastructure Engineer owns

• Cloud foundation and landing zones
• AWS accounts, governance and networking
• Identity, access and Zero Trust
• Corporate endpoints and remote access
• Infrastructure as Code and infrastructure CI/CD
• Hosting infrastructure, monitoring, backup and DR
• Cloud cost management and infrastructure standards

Key Responsibilities

• Take Alare's HLA through Low-Level Design and implementation, maintaining architecture documentation and decision records.
• Own technical decisions relating to cloud, identity, networking, infrastructure security, resilience and operations.
• Create repeatable infrastructure across the USA, EU, and Asia using automation rather than manual administration.
• Establish infrastructure standards, governance, runbooks and operational handover.
• Provide technical direction to suppliers and future infrastructure engineers.

Note: all technologies are subject to change, and the company will be expecting the Lead Infrastructure Engineer to contribute to or own technology decisions and choices.

Open-Source-First Infrastructure
AlareLeadership Inc. wants to avoid unnecessary recurring licensing. The engineering principle is: open source where practical; managed cloud where it materially reduces operational risk; commercial software where there is a demonstrable business or security justification.

• OpenTofu – preferred Infrastructure as Code platform; validate module structure, state protection, plan/apply workflow, and drift control.
• OpenZiti – candidate identity-aware Zero Trust Network Access platform; validate operational supportability and HA model.
• Wazuh – candidate open-source SIEM/XDR platform for early-stage security monitoring.
• Prometheus + Grafana – metrics, alerting, and operational dashboards.
• Grafana Loki – lower-cost operational log aggregation.
• GLPI – candidate IT service-management platform.
• Snipe-IT – candidate asset inventory and lifecycle platform.
• Ansible – configuration automation where declarative cloud/IaC controls are insufficient.

Linux and container-based services where these are the most supportable and cost-effective option.
These are proposed technologies rather than mandated products. A key responsibility is to test whether each remains appropriate as Alarè scales, and to recommend managed or commercial alternatives when operational risk or total cost of ownership justifies them.

AWS & Global Infrastructure

• AWS Organisations and Control Tower; multi-account structure; security and log archive accounts; SCPs and IAM Identity Center.
• VPC architecture, subnets, security groups, WAF, Route 53, load balancing and private connectivity.
• CloudTrail, GuardDuty, Security Hub, CloudWatch and VPC Flow Logs.
• Secrets Manager, KMS, backup/recovery and cross-region connectivity.
• Repeatable regional landing zones for Region 1 – USA, Region 2 – EU and Region 3 – Asia.
• Cost tagging, budgets and cloud-cost governance.

Infrastructure as Code & Pipeline

• OpenTofu modules, protected remote state, environment separation and provider/version control.
• Git-based change control with plan/apply approval workflows.
• Infrastructure security scanning, policy checks, drift detection and automated validation.
• Infrastructure pipeline: Git → validation → OpenTofu plan → security checks → approval → apply → post-deployment validation → monitoring.
• Work with the Software Lead and Test Lead at integration boundaries; application build/deployment logic remains owned by Software Engineering.

Zero Trust & Corporate Infrastructure

• Identity-first architecture using Entra ID, SSO, MFA, Conditional Access, PIM and B2B.
• Managed endpoints through Intune and Defender for Endpoint.
• Azure Virtual Desktop where appropriate for contractors, BYOD or privileged scenarios.
• Application-specific ZTNA, with OpenZiti as a candidate technology.
• AWS IAM Identity Center with short-lived/federated credentials.
• Domain rationalisation, joiner/mover/leaver controls, privileged administration and asset management.

Requited Experience

• Strong AWS architecture and engineering.
• Infrastructure as Code using Terraform and/or OpenTofu.
• Demonstrable Zero Trust architecture experience.
• Cloud networking and security.
• Microsoft Entra ID and modern identity controls.
• CI/CD, Git workflows, and infrastructure automation.
• Linux, monitoring/logging, backup and disaster recovery.
• Ability to operate as both architect and hands-on engineer.

Desireable Experience

• OpenTofu, OpenZiti, Wazuh, Prometheus, Grafana, Loki, Ansible, GLPI or Snipe-IT.
• AWS Control Tower, multi-account and multi-region AWS.
• Intune, Defender, and Azure Virtual Desktop.
• Containers, ECS/EKS and managed cloud services.
• SOC 2, ISO 27001, SaaS and start-up/scale-up environments

Future CTO Opportunity (non-binding)
As the organization develops, the successful candidate may have the opportunity to progress into the Chief Technology Officer role, introducing responsibility for overall technology strategy, architecture governance, organization design, suppliers, technology budgets, recruitment and technical representation to customers and investors. Until such a transition is formally agreed, the role remains bounded around infrastructure, cloud, Zero Trust/security architecture, and technical platform services, with application/software engineering remaining under the Software Lead.

Engagement Structure & Path to Full-Time Employment
This role begins as an independent contractor engagement, compensated through an equity grant subject to Board approval and standard vesting documentation. AlareLeadership Inc. is an early-stage company, and this structure reflects where we are today — not the ceiling of what this role becomes. As the company advances and grows, the company intends to discuss with the contractor a potential path to a full-time, salaried employment relationship with a market-rate compensation package, variable pay, and benefits. Nothing in this description constitutes a binding offer of employment, a guarantee of equity value, or a promise of future funding.