« Track Overview

The Role — Senior Engineer, Platform Engineering & Architecture (Enterprise AI & Agentic Platform)

Location: Abu Dhabi, United Arab Emirates Sector: Tier-1 banking group, regulated by the CBUAE (Central Bank of the UAE) Level: Senior / Staff / Principal individual contributor — the senior technical authority for the platform Operating model: Two-in-a-box with the existing Platform Product Owner — concurrent technical ownership, shared on-call, shared roadmap, shared accountability

Table of Contents

• Job summary
• Key accountabilities — platform architecture
• Key accountabilities — integrations & model layer
• Key accountabilities — identity, security & governance
• Key accountabilities — infrastructure & run-state
• Requirements — technical expertise
• Requirements — engineering leadership & collaboration
• Minimum experience
• Qualifications
• How this track maps to the JD
• Resume & application keywords
• What makes this role unusual

Job summary

Lead the engineering, architecture, and run-state ownership of the bank's enterprise AI & Agentic Platform — ensuring it operates as a reliable, secure, observable, bank-grade production platform supporting agents and AI workloads across the Group.

The role is the senior technical authority for platform engineering and architecture across:

• the agentic runtime,
• the model gateway,
• the integration fabric,
• the identity layer, and
• the infrastructure backbone.

It operates in a two-in-a-box model with the existing Platform Product Owner, providing concurrent technical ownership and organizational resilience, with shared accountability for platform availability, performance, cost, security posture, and architectural evolution.

The role is deeply technical: hands-on engineering depth across distributed systems, agentic protocols, LLM infrastructure, identity and access management, and cloud-native platform engineering.

Key accountabilities — platform architecture

• Own the end-to-end technical architecture of the platform's five-layer stack: Action Gateway, Agent Kernel, Control Plane, Knowledge Foundation, and the Users and Channels layer.
• Architect and evolve the agentic runtime to natively support the emerging multi-protocol stack: Model Context Protocol (MCP) for agent-to-tool access, Agent-to-Agent (A2A) for inter-agent coordination and task delegation, Agent Communication Protocol (ACP) and equivalent emerging standards — ensuring interoperability with hyperscaler agent fabrics (Azure AI Foundry agents, AWS Bedrock Agents, Google ADK).
• Design the agent kernel: agent lifecycle management, planning and reasoning loops, memory architecture (short-term, long-term, episodic), state management, session affinity, scratchpad persistence, and execution chains.
• Architect the knowledge foundation: vector store selection and topology, hybrid retrieval (BM25, dense, graph), embeddings strategy, knowledge-graph integration (FIBO, OWL, SHACL, SPARQL), context engineering, and grounding patterns.
• Design the control plane: policy-gated execution, Know Your Agent (KYA) enforcement at runtime, agent registries, tool registries, capability discovery, evaluation pipelines, and tracing and lineage at agent and tool granularity.

Key accountabilities — integrations & model layer

• Architect and engineer the LLM gateway and model abstraction layer: a unified interface across foundation-model providers (Azure AI Foundry, AWS Bedrock, OpenAI, Anthropic, Google Vertex AI, Cohere) with intelligent routing, fallback, retries, prompt and response caching, semantic caching, rate limiting, token accounting, cost attribution, and tenant isolation.
• Design model serving patterns for managed APIs, dedicated capacity (PTUs / provisioned throughput), and self-hosted open-weight models on GPU infrastructure (vLLM, TGI, Triton, or equivalent) — with explicit trade-offs across cost, latency, sovereignty, and compliance.
• Lead integration architecture between the AI Platform and the bank's core estate: core banking, payments, treasury, credit and risk systems, the enterprise data platform (Azure, Cloudera, Databricks), enterprise APIs, ESB, event streaming (Kafka, Event Hubs), and the data product layer.
• Design the action gateway as the bank's enforcement boundary for agentic action: API mediation, contract enforcement, circuit breakers, idempotency guarantees, transactional safety, and audit-grade action logging.
• Engineer the tool layer and MCP server estate: tool packaging, versioning, capability advertisement, schema enforcement, and runtime tool discovery across Wholesale, Retail, and Group functions.

Key accountabilities — identity, security & governance

• Architect and own the agent identity and workload identity model: non-human identity (NHI) management, agent identity lifecycle, blended user-plus-agent identity for delegated actions, and the identity propagation chain across multi-agent flows.
• Design the authentication and authorization architecture: OAuth 2.1 and OIDC flows for agent-to-tool and agent-to-API interactions, just-in-time credential issuance, short-lived token exchange, mTLS for agent-to-agent communication, and integration with enterprise IAM (Microsoft Entra ID, PAM, secrets management).
• Implement zero-trust principles across the agentic stack: least-privilege scoping per agent and per task, real-time policy evaluation, behavioral posture checks, and continuous authorization rather than static service-account-style access.
• Engineer runtime governance controls: KYA enforcement, prompt and output guardrails (PII, PHI, MNPI, prompt-injection defense), sensitive-action approval flows, and human-in-the-loop escalation patterns.
• Harden the platform to meet CBUAE, internal model risk, and Group governance requirements: auditability, lineage, data residency, model-risk controls, third-party model governance, and OWASP LLM Top 10 alignment.

Key accountabilities — infrastructure & run-state

• Lead cloud and infrastructure architecture across Azure (primary) and AWS: infrastructure as code (Terraform), networking (private endpoints, peering, egress control), Kubernetes (AKS) and container orchestration, secrets management, CI/CD.
• Own platform Site Reliability Engineering: SLO design, error-budget management, observability (OpenTelemetry — traces, metrics, logs at agent and tool granularity), incident response, post-mortems, capacity planning, and cost governance for a growing fleet of agents and AI workloads in production.
• Operate in genuine two-in-a-box with the Platform Product Owner: shared on-call, shared roadmap ownership, shared accountability for major architectural decisions, regulator conversations, and critical incidents.
• Drive engineering excellence: testing discipline (unit, integration, evaluation, red-teaming), documentation, IaC maturity, operational readiness reviews, and technical mentorship of platform engineers.
• Represent the platform in senior technical forums with Enterprise Architecture, Cyber, Model Risk, Internal Audit, and the Group CTTO's office.
• Engage with hyperscaler, model-provider, and framework vendor technical teams on integration, performance, sovereignty, and cost optimization.

Requirements — technical expertise

Requirements — engineering leadership & collaboration

• Demonstrated ability to operate in a two-in-a-box model with another senior technical owner: shared accountability, shared on-call, shared decision-making.
• Track record of raising engineering standards across a platform team through standards, design reviews, documentation, and direct technical mentorship.
• Strong written and verbal communication — credible with engineers, architects, risk and audit functions, hyperscaler and vendor technical teams, and senior business stakeholders.

Minimum experience

• 10+ years in software and platform engineering, significant time at senior / staff / principal engineer or architect level.
• Demonstrated production ownership of at least one platform serving multiple internal or external consumers at enterprise scale — ideally including agentic or LLM workloads.
• Substantive experience in financial services, banking, or another comparably regulated industry.
• Demonstrated SRE and on-call experience on a production platform with meaningful availability and operational requirements.
• Track record of building, integrating, or operating LLM-based or agentic systems in production.

Qualifications

Minimum: Bachelor's degree in Computer Science, Software Engineering, Electrical Engineering, or a related technical discipline.

Preferred: MSc / MTech / MEng in Computer Science, Software Engineering, or Distributed Systems. Certifications considered an advantage:

• Cloud — Azure Solutions Architect Expert, Azure DevOps Engineer Expert, AWS DevOps Professional, AWS Solutions Architect Professional, Certified Kubernetes Administrator (CKA).
• Security — CISSP, CCSP.
• SRE — any recognized SRE certification.

How this track maps to the JD

The JD names five architectural layers. This track is organized so that every layer has phases that build its mechanism, and the capstone composes all five into one platform:

Resume & application keywords

Terms an ATS and a hiring architect will both look for — every one of these is built somewhere in this track, not merely named:

AI platform architecture · agentic runtime · Model Context Protocol (MCP) · Agent-to-Agent (A2A) · Agent Communication Protocol (ACP) · agent kernel · agent lifecycle · episodic memory · session affinity · LLM gateway · model abstraction layer · intelligent routing · provider fallback · semantic caching · token accounting · cost attribution · tenant isolation · provisioned throughput (PTU) · vLLM · TGI · Triton · KV-cache · continuous batching · hybrid retrieval · BM25 · reranking · pgvector · Azure AI Search · knowledge graph · FIBO · RDF · OWL · SHACL · SPARQL · Neo4j · Apache Jena · non-human identity (NHI) · workload identity · SPIFFE · SPIRE · OAuth 2.1 · OIDC · RFC 8693 token exchange · mTLS · just-in-time credentials · secret-less architecture · Microsoft Entra ID · PAM · zero trust · continuous authorization · Know Your Agent (KYA) · policy-as-code · OPA · Rego · Cedar · Azure Policy · action gateway · idempotency · saga / compensation · circuit breaker · audit-grade logging · prompt injection · OWASP LLM Top 10 · PII / PHI / MNPI · human-in-the-loop · CBUAE · model risk · SR 11-7 · data residency · sovereignty · lineage · ISO 20022 · Kafka · Event Hubs · ESB · core banking · data products · Terraform · AKS · EKS · Helm · Istio · Envoy · APIM · Kong · private endpoints · OpenTelemetry · SLO · error budget · burn-rate alerting · FinOps · operational readiness review · two-in-a-box

What makes this role unusual

Four things separate this JD from a normal "AI platform engineer" posting, and this track is built around them:

1. It is a platform role, not an application role. You are not shipping an agent. You are shipping the substrate on which dozens of teams ship agents — which means multi-tenancy, registries, contracts, quotas, and a support model are first-class deliverables, not afterthoughts.

2. It is regulated. The bank answers to the CBUAE. Every design decision carries an evidence obligation: who approved this agent, what data did it touch, in which jurisdiction did the inference run, can you reproduce the decision six months later for an auditor. A design that cannot produce evidence is not a design.

3. The identity problem is genuinely new. Human identity and service identity are solved problems. Agent identity is not. An agent acts on behalf of a user, over multiple hops, with dynamically discovered tools, sometimes delegating to other agents. Static service accounts collapse under that. This JD asks for NHI, blended user-plus-agent identity, JIT credentials, and continuous authorization because nothing simpler survives contact with a real agentic flow.

4. Two-in-a-box is a real operating model, not a title. Shared on-call and shared architectural accountability with a Product Owner means the engineering work and the product work are deliberately fused. The seniority signal is not "I can design this" — it is "I can design this, defend it to Internal Audit, run it at 3 a.m., and hand it to my counterpart without a gap."

References

• CBUAE — Central Bank of the UAE regulatory framework, and the UAE's Information Assurance Standards / data-sovereignty expectations for financial institutions.
• Model Context Protocol — modelcontextprotocol.io and the dated protocol specification revisions.
• Agent2Agent (A2A) — a2a-protocol.org, donated to the Linux Foundation in 2025.
• Agent Communication Protocol (ACP) — agentcommunicationprotocol.dev.
• OWASP — Top 10 for LLM Applications & Generative AI.
• Federal Reserve / OCC — SR 11-7, "Guidance on Model Risk Management" — the canonical model-risk framework most bank internal standards are derived from.
• ISO 20022 — iso20022.org message definitions for payments.
• EDM Council — FIBO (Financial Industry Business Ontology).
• Google SRE — Site Reliability Engineering and The Site Reliability Workbook, O'Reilly.