Head of Platform Engineering

Canadian Bank Note Company (CBN) is a leader and trusted provider of secure document and adjacent enterprise-level system solutions across the following domains: border security, civil identity, driver licence/identification and vehicle information, excise control, currency, lotteries and charitable gaming.

Our Corporate Philosophy and 7 Core Principles shape and guide our corporate behaviours and underpin the sense of community you will experience at CBN. We seek long-term relationships with our employees and offer a competitive compensation package that includes health, medical and life insurance benefits and a defined contribution pension plan with company matching.

Job Title: Head of Platform Engineering

Job Type: Permanent, Full-time

Job Location: 18 Auriga Drive, Ottawa ON

Work Model: Hybrid

Job Status: Existing Vacancy

Position Summary

CBN has set out to become the leading global platform provider for managing government ID and ID-enabled services. As Head of Platform Engineering, you will build and run that platform: allowing for applications and services to deploy the same way across environments such as Azure, on-prem Red Hat OpenShift, AWS and air-gapped customer sites, with security and compliance built in by design.

You will lead platform teams, translate CBN's vision into the platform roadmap, own technical direction, and stay close to implementation through design reviews, infrastructure-code reviews and complex production troubleshooting.

Key Responsibilities

• Platform Architecture and Scale: Set technical direction, review designs and resolve cross-team technical problems across Azure (AKS, hub-and-spoke landing zones) and Kubernetes/OpenShift. Design for national-scale identity services and hundreds of millions of credential verifications annually.
• Engineering and Delivery: Work directly with engineers on GitOps, CI/CD and infrastructure automation using Argo CD, Helm, Terraform and JFrog Artifactory. Establish reusable deployment patterns and go-live standards, including secured registries, offline upgrades and signed release bundles verified at air-gapped sites.
• Reliability: Diagnose complex production failures alongside engineers and drive lasting fixes. Set SLOs, observability and capacity requirements using OpenTelemetry and visualization tooling; oversee L2/L3 support and problem management, and verify that backups and disaster recovery work.
• Security by Design: Embed security gates, SBOMs, image signing, SAST/DAST and automated SOC 2/ISO 27001 evidence into delivery. Own Platform's control responsibilities with Security (patching, hardening, access reviews, backups/DR), identify and close security deviations at scale and support audits.
• AI-Enabled Engineering: Support spec-driven development and enhance agents for delivery, change preparation, incident triage, runbook automation, and human approval with audit trails.
• Platform Strategy and Adoption: Translate CBN's vision into a practical roadmap. Work with product, engineering and service delivery teams to onboard jurisdictions, reduce bespoke deployments and improve developer experience. Support platform bids and explain investment, capacity, commitments and risk to executives.
• Team and Budget Leadership: Hire and develop strong engineers and team leads, allocate staff across DevOps, Infrastructure and DevEx functions, and hold teams accountable for delivery. Own platform spend and vendor contracts, working with Infrastructure & Operations on cost optimisation.

Mandatory Qualifications

• Legally eligible to work in Canada
• Fluent in English (speak, read, write)
• Able to obtain (in a timely manner) and maintain Government of Canada Secret (Level II) security clearance
• Able to work evenings, weekends and holidays as required during security incidents and customer go-lives
• Able to travel approx. 1-2 weeks/year

Minimum Qualifications

• Education: Bachelor's degree in Computer Science, Engineering or a related field, or equivalent experience
• Experience: 10+ years in infrastructure or software engineering leadership, including 5+ years managing leads or managers across multiple teams.
• Operating Record: Demonstrated improvements in production reliability, performance or operating cost. Able to explain the baseline, engineering changes and resulting outcomes.
• Recent Hands-On Engineering: Recent experience writing design specifications, implementing infrastructure or deployment automation, and reviewing code and configurations. Able to diagnose complex production failures alongside engineers.
• Technical Depth: Deep practical experience in at least two of the following, with sufficient understanding of distributed systems to assess failure modes and architectural trade-offs:
  • Kubernetes/OpenShift operations (upgrade strategies, networking, secrets management, cluster reliability)
  • Azure or AWS infrastructure (well-architected frameworks, FinOps/Cost Management, networking, identity, subscription design strategies)
  • CI/CD and GitOps (Argo CD, Terraform, Helm, Pipeline Implementation)
  • Reliability engineering (SLOs/Error Budgets, Monitoring Workspaces, Cross-Region Failover, Chaos Engineering)
• Platform Delivery and Adoption: Built or substantially modernised a shared platform from design through production adoption, including upgrades, rollback and operational handover. Experience delivering into regulated, government or disconnected environments, with measurable improvements, e.g. DORA metrics, onboarding time or developer satisfaction.
• Secure Automation: Implemented controlled, repeatable releases using infrastructure as code and GitOps.
• Technical Leadership: Hired and developed strong engineers and leads, and made technical decisions under competing delivery, reliability, security and cost constraints.
• AI in Practice: Used AI agents in delivery or operations with human oversight and an audit trail.
• Business Accountability: Owned cloud spend and vendor contracts, and explained platform investment, technical trade-offs and risk to product, finance, Security/GRC and executive stakeholders.

Preferred Qualifications

• Experience leading or working closely with forward-deployed, solutions or pre-sales engineers, including technical bid and RFP answers
• Identity and edge infrastructure: IDP/PAM, PKI, Load Balancing, Zero Trust, CDN/Edge Caching
• Policy-as-code and supply-chain security: OPA/Kyverno, SAST/DAST, SBOMs, External Secrets
• Microservice and distributed architectures, scalable hub-and-spoke topologies and high-volume data operations

Equal Opportunity Statement

Our organization is committed to employment equity and diversity in the workplace. We actively encourage applications from women, Indigenous Peoples, persons with disabilities, members of visible minorities, and LGBTQ2+ individuals.

We are dedicated to removing barriers and fostering an inclusive workplace that reflects society and we are committed to providing an accessible and inclusive recruitment process in accordance with the Accessibility for Ontarians with Disabilities Act (AODA).

If you require accommodation at any stage of the hiring process, please contact us at [email protected] so that appropriate arrangements can be made.

AI Use in Recruitment Statement

As part of our commitment to transparency and fairness in hiring, we disclose that artificial intelligence (AI) tools may be used at certain stages of our recruitment process. These tools assist in tasks such as resume screening, candidate matching, and interview scheduling. All AI-assisted decisions are subject to human oversight to ensure fairness, accuracy, and compliance with applicable laws.

We are committed to the responsible, transparent, and accountable use of AI, in alignment with Ontario’s Responsible Use of Artificial Intelligence Directive and the requirements under the Working for Workers Four Act. This includes taking steps to mitigate bias, protect candidate privacy, and ensure that AI does not unfairly influence hiring outcomes.

If you have questions or concerns about how AI is used in our hiring process, please contact us at [email protected] .