« All Roles

Agentic AI Engineer — Agent Infrastructure, Platforms & Production Systems

Target Roles: The Staff / Senior / Lead / VP agentic-AI engineering postings collected in jd.md — Citi (Lead Agentic AI Engineer VP; Agentic AI Technical Lead), Docker (Staff SWE, Agentic Platform), Cohere (Senior SWE, Agent Infrastructure), Temporal (Staff SWE, AI Foundations), Juniper Square (Staff SWE, AI), Redcan.ai (Staff SWE, Agentic AI Products), Wolters Kluwer (Senior Full-Stack, AI Platform & Agents), OpenAI (SWE / Security Engineer, Agent Infrastructure/Security), Anthropic (Agent Prompts & Evals / Claude Code), LiveKit (Staff Rust SDK, real-time agents), RBC (Staff Engineer, Agentic AI).

What this track is (and what it is not). This is not "call the OpenAI API and add a chatbot." It is the layer those roles actually hire for: the infrastructure, platform, and production discipline that makes agents reliable, secure, evaluable, multi-tenant, durable, and cheap enough to run at enterprise scale. You will build the mechanisms the frameworks only expose — the agent runtime, the MCP server, the durable workflow engine, the sandbox, the guardrail chain, the eval harness, the multi-tenant gateway — so you can debug them at 2 a.m. and defend them in a Staff/Principal interview.

Relationship to the Senior AI Engineer track. That track goes down the stack — transformer internals, autograd, sampling, quantization, distributed training — the model mechanisms. This track goes up and around the model — the agent and platform mechanisms. They share a spine (the ReAct loop, tool calling, RAG, evaluation appear in both) but the lens is different: there you build the sampler; here you build the runner, the sandbox, the durable workflow, and the tenant boundary that call it. Where a topic is covered at model-depth there, we cross-link and go platform-deep here.

Duration: ~30 weeks core (≈7 months) at one phase/1.5 weeks, extendable with the capstone. Seniority Target: Senior → Staff → Principal / Lead IC — the person who owns the agent platform, makes the reliability/cost/latency/security tradeoff, and is the escalation point when an agent loops, leaks a tool secret, hallucinates a tool call, exfiltrates a customer record, or blows the token budget. Goal: Make you the engineer who can architect a secure, multi-tenant, durable, evaluated agent platform at the system level and debug it at the tool-schema, MCP-message, event-replay, capability-check, injection-vector, judge-calibration, cache-key, quota-bucket, and trace-span level — across the agent runtime, tool integration, retrieval, orchestration, durability, sandboxing, security, evaluation, serving, tenancy, and observability.

Why This Curriculum Exists

Every JD in jd.md is a variation on one sentence: "build the platform that runs agents reliably in production." Read them together and the same words recur — agent infrastructure, agentic platform, MCP, tool calling, context engineering, ReAct/ReWOO, GraphRAG/LightRAG/RAPTOR, multi-agent, durable execution, sandboxing, secure execution, LLM-as-judge, golden datasets, behavioral regression, guardrails, multi-tenant, observability, cost/latency optimization, human-in-the-loop. None of those are "prompt engineering." They are distributed-systems, security, and evaluation problems that happen to have an LLM in the loop.

The discipline rests on five load-bearing truths this track hammers in every phase:

1. The model proposes, the application executes. The LLM is a stochastic oracle that emits text. It never runs a tool, moves money, or reads a file — your code does, after validating. Every security, reliability, and correctness property lives on your side of that trust boundary. (Phases 02, 03, 09, 10, 13.)
2. Reliability compounds multiplicatively. A 95%-reliable step, ten steps deep, is \(0.95^{10} \approx 0.60\). Agents are loops over an unreliable oracle, so the whole craft is constraining and verifying that oracle: typed tools, validation, retries, critics, evals, human gates. "Least-agentic that works" is a design principle, not laziness. (Phases 00, 01, 07, 11.)
3. Untrusted text becomes instruction. An LLM mixes instructions and data in one channel and cannot reliably tell them apart, so any text it reads — a web page, a tool result, a document, its own memory — can become a command. Prompt injection has no general fix; it is contained architecturally (least privilege, allow-lists, output scanning, human approval), never prompted away. (Phase 10, threaded everywhere.)
4. Every request costs money and time, and both are engineered, not observed. Tokens, cache hits, model routing, latency budgets, quotas — margin is built. You instrument cost and latency on day one or you find out from the invoice. (Phases 00, 14.)
5. An agent you cannot evaluate, you cannot ship. "It worked in the demo" is a sample of one from a distribution. Golden datasets, trajectory evals, LLM-as-judge, behavioral regression tests, and evals-as-CI-gates are the difference between a demo and a platform. (Phase 11, threaded everywhere.)

So this track is built on two non-negotiables:

1. Every mechanism in the JDs gets implemented, not just described — the ReAct/ReWOO runner, the JSON-Schema tool validator and repair loop, the MCP JSON-RPC 2.0 server and client, the context assembler and intent router, the hybrid retriever with RRF and reranking, the RAPTOR tree and mini-GraphRAG, the multi-agent message bus and critic loop, the event-sourced replay-safe workflow engine with a human-approval signal, the capability-gated sandbox, the layered injection guardrail chain, the golden-dataset + trajectory + LLM-judge eval harness with a regression gate, the async streaming agent service, the multi-tenant authz/isolation/quota gateway, the model-router + semantic-cache + cost-meter + OTel tracer, and the spec→plan→apply-patch coding loop. You build a working, tested miniature of each (see LAB-STANDARD.md).
2. Everything is taught to the depth interviews and incidents demand — why an agent loop is not replay-safe but a durable workflow is; the exact JSON-RPC handshake MCP does at initialize; why 0.95^10 ≈ 0.60 decides your architecture; the difference between ReAct's interleaving and ReWOO's plan-then-execute token economics; how RAPTOR's recursive clustering answers a question BM25 can't; why a shared vector index is the #1 multi-tenant leak channel; how an indirect prompt injection in a fetched web page exfiltrates a secret via a markdown image URL; why LLM-as-judge needs a human-agreement (Cohen's κ) check before you trust it in CI.

How Each Phase Teaches (the "many ways of explaining")

The lab engineering standard is in LAB-STANDARD.md. Read it before Lab 01.

The Phases

Part II — Frameworks Deep Dive (Phases 18–24)

Phases 00–17 build the mechanisms framework-agnostically. Part II turns to the real frameworks a principal engineer is expected to know cold, and studies each by building a faithful miniature of its execution model plus a principal-depth guide to the real API, gotchas, and when to choose it. Every framework named in jd.md (Citi's LangGraph/CrewAI/AutoGen/Google ADK; Temporal's OpenAI Agents SDK/Pydantic AI) — plus AWS's AgentCore and the Amazon Bedrock platform under it — gets its own phase with multiple labs.

Part III — Cloud AI Platforms, MLOps & Production Infrastructure (Phases 25–28)

The AI/ML-Engineer and OKE-SRE JDs ask for the production plane around the model: managed cloud AI platforms, MLOps discipline, data/feature engineering at scale, and Kubernetes-native operations. Each phase builds a faithful stdlib miniature of the real system plus the four principal-depth docs.

Part IV — GenAI Frameworks & ML Foundations (Phases 29–32)

Part V — Eval-Driven Development (Phase 33)

Use the sidebar for the full clickable table of contents, and see GLOSSARY.md / CHEATSHEET.md for the running references. interview-prep/ has per-company drills; system-design/ has full platform-design walkthroughs.

How to Use This Track

1. Read Phase 00 end to end first — it builds the mental model (the trust boundary, the 0.95^n reliability math, the cost/latency dials, "least-agentic that works") that every later phase plugs into.
2. For each phase: read WARMUP.md (professor), skim HITCHHIKERS-GUIDE.md (the numbers), do the lab (lab.py red → green against test_lab.py), then read the four principal deep-dives — DEEP-DIVE.md (mechanism), PRINCIPAL-DEEP-DIVE.md (architecture), CORE-CONTRIBUTOR.md (how the real system does it), and STAFF-NOTES.md (judgment & interview signal).
3. Work phases roughly in order — the loop (P01), tools (P02), and MCP (P03) underpin everything; orchestration (P07) assumes the loop; the capstone (P17) assumes P01–P14.
4. Use interview-prep/ and system-design/ as running references; map each company in jd.md to its heaviest phases (Citi → 03/04/06/07/13; Docker → 03/09/10/11; Temporal → 08/15; OpenAI Security → 09/10/13).

Cross-Cutting Themes (the agentic platform engineer's lenses)

• The trust boundary is the product. Model proposes, app executes. Every phase either sits on your side of that line (validation, sandbox, authz, guardrail) or defines where the line is. Draw it wrong and the injection/exfil/privilege bug is unavoidable no matter the prompt.
• Reliability is a budget you spend, not a hope. 0.95^n says how many autonomous steps you can afford before you must checkpoint, verify, or ask a human. Durable execution (P08), evals (P11), and multi-agent critics (P07) all exist to buy steps back.
• Context is finite and expensive. The window is a budget; retrieval (P05/06), memory and compression (P04), and caching (P14) all fight the same scarcity. "Put more in the prompt" is a cost and a latency decision, and past some point a quality regression (lost-in-the-middle).
• Agents are distributed systems. Retries, idempotency, at-least-once vs exactly-once, event sourcing, backpressure, quotas, tenancy, tracing — the agent parts are new, the systems parts are the ones that page you. P08/P12/P13/P14 are systems phases with an LLM inside.
• Every claim maps to a number. 0.95^10, $/resolved-task, recall@k, p50/p95/p99, tokens/turn, cache-hit-rate, κ agreement, quota buckets. You do this arithmetic before the design review, not after the incident. Every phase ends with a number you can defend.
• Security is architectural, not promptable. You cannot instruct a model into being safe. Least privilege, allow-lists, sandboxing, output scanning, human-in-the-loop, and tenant isolation are code. Prompting is a mitigation, never a control.