We are looking for a Principal Software Engineer to join Procore’s Government Engineering team as the technical lead for how our FedRAMP platform is provisioned, organized, and governed. This is a hands-on architecture and engineering role: you will set the direction for infrastructure as code across the authorization boundary, build the provisioning systems that stamp out compliant accounts, environments, and clusters, and write the software that makes that infrastructure self-service, auditable, and reliable. You will bring an SRE mindset to the work, treating reliability, operability, and compliance as engineering problems to be solved in code rather than in tickets.

The impact of this role is wide: the foundation you design is what every service inside Procore’s FedRAMP authorization boundary runs on, and it MUST respect and protect that boundary. We build with modern tooling, including AI-assisted development and AI-driven automation, so that a small team can run a large, compliant platform without drowning in toil.

This position reports to the Senior Engineering Manager of the Government Engineering team and is a hybrid role based out of our Austin, TX office. Consideration will be made for this role to be based in Carpinteria, the Bay Area, or NYC. This position requires US citizenship to work on FedRAMP-compliant projects. Candidates must be eligible to work on federal government projects requiring FedRAMP authorization.

What you’ll do:

• Own infrastructure as code for the boundary: Define the architecture, module standards, and delivery workflow for all FedRAMP infrastructure in Terraform (or similar), and drive the platform toward fully codified, reviewed, and automatically deployed infrastructure.
• Design provisioning and organization: Architect how cloud accounts, organizational units, networks, Kubernetes clusters, and environments are structured and provisioned inside the authorization boundary, including landing zones, guardrails, and account vending, so that new workloads land compliant by default.
• Build the provisioning platform: Write production software (Go, Python, or TypeScript) for the controllers, pipelines, and internal tooling that turn infrastructure requests into reviewed, policy-checked, automatically applied changes.
• Apply AI to infrastructure: Use AI-assisted development tooling daily, and build AI-driven automation into the platform: agents that draft and validate IaC changes against policy, generate compliance evidence from infrastructure state, and detect and remediate drift.
• Set technical direction: Own the multi-year platform architecture, write and review design documents, make build-versus-buy decisions, and align engineering, security, and compliance stakeholders on the roadmap.
• Engineer for compliance: Translate FedRAMP controls (NIST SP 800-53) for configuration management, change control, and boundary protection into policy-as-code and automated evidence, and partner with security on continuous monitoring (ConMon) and annual assessment readiness.
• Run the platform like an SRE: Establish reliability standards, SLOs, and incident practices for the provisioning layer, and lead the response when the foundation itself has problems.
• Lead and multiply: Mentor Staff and Senior engineers, lead cross-team migrations onto the standard platform, and act as the final technical authority for infrastructure decisions inside the boundary.

What we’re looking for:

• Experience: 12+ years of software, infrastructure, or site reliability engineering experience, including at least 3 years operating within a FedRAMP-authorized or similarly regulated environment, with hands-on AWS GovCloud experience.
• Infrastructure as code mastery: Deep, hands-on expertise designing and scaling Terraform (or similar) across many accounts and environments: module design, state management, policy-as-code (e.g., OPA, Sentinel, Checkov), and GitOps-based delivery.
• Cloud organization and provisioning: Proven experience designing multi-account cloud organizations, landing zones, account vending, network topology, and IAM boundaries at scale, and an understanding of how those choices map to compliance controls.
• Software engineering proficiency: Strong programming fundamentals and a track record of shipping production software in Go, Python, or TypeScript, including internal platforms and developer tooling used by other engineers.
• Kubernetes expertise: Extensive experience architecting, provisioning, and hardening Kubernetes clusters as code, including policy enforcement (e.g., OPA/Gatekeeper, Kyverno) and secrets management.
• Technical leadership: A history of setting architecture direction for a platform organization, writing design documents that others build from, and influencing without authority across engineering, security, and compliance.
• SRE practice: Experience owning reliability for foundational infrastructure, including incident command, postmortems, and systematic toil reduction.
• AI tooling: Comfort using AI-assisted development tools in daily work, and a point of view on how AI should be applied to infrastructure automation.

Nice to Have:

• Experience with cloud traffic, service mesh, and observability tooling (Istio, Kong, Cloudflare, Datadog).
• Experience with IAM architecture (Okta, SAML/OIDC, zero-trust) and FIPS 140-2/140-3 validated cryptography in practice.
• Experience with secrets management platforms operating in FIPS mode (e.g., HashiCorp Vault).
• Familiarity with FedRAMP Rev 5 requirements, STIG application, or CIS benchmark enforcement at scale.
• Experience building AI agents or ML-driven automation for infrastructure (AIOps).
• Certifications such as HashiCorp Terraform Authoring and Operations Professional, AWS Solutions Architect - Professional, CKA/CKS, or CISSP.

Additional Information

Base Pay Range:

198,240.00 - 272,580.00 USD Annual

This role may also be eligible for Equity Compensation and/or Bonus Incentive Compensation. Procore is committed to offering competitive, fair, and commensurate compensation. Actual compensation will be based on a candidate’s job-related skills, experience, education or training, and location.

This position requires access to technology, software, and data that is controlled or restricted under U.S. law, regulation, executive order, or government contract.

For Los Angeles County (unincorporated) Candidates:

Procore will consider for employment all qualified applicants, including those with arrest or conviction records, in accordance with the requirements of applicable federal, state, and local laws, including the City of Los Angeles’ Fair Chance Initiative for Hiring Ordinance, the Los Angeles County Fair Chance Ordinance for Employers, and the California Fair Chance Act.

A criminal history may have a direct, adverse, and negative relationship on the following job duties, potentially resulting in the withdrawal of the conditional offer of employment: 1. appropriately managing, accessing, and handling confidential information including proprietary and trade secret information, as well as accessing Procore's information technology systems and platforms; 2. interacting with and occasionally having unsupervised contact with internal/external customers, stakeholders, and/or colleagues; and 3. exercising sound judgment.