Job Description

Founded in Switzerland in 1968, Zühlke is owned by its partners and located across Europe and Asia. We are a global transformation partner, with engineering and innovation in our DNA. We're trusted to help clients envision and build their businesses for the future – to run smarter today while adapting for tomorrow’s markets, customers, and communities. Our multidisciplinary teams specialise in tech strategy and business innovation, digital solutions and applications, and device and systems engineering. We excel in complex, regulated spaces including health and finance, connecting strategy, tech implementation, and operational services to help clients become more effective, resilient businesses.

If you share our values and want to do the best work, for the right reasons, we can offer you the chance to do it on a global scale and play a real role in shaping our exciting journey.

The Role

Zühlke is building one knowledge base for the whole firm: skills, project experiences and official documents that every colleague and every AI assistant can use. AI clients such as Claude Code or GitHub Copilot reach it through a single governed access layer. Behind that layer sit the knowledge sources and, from 2027, our business systems, each connected as an MCP server.

As an AI Platform Engineer you build and run this platform. The access layer has an identity broker, an API gateway and an MCP composer that offers search, fetch and invoke over all connected sources. Every request carries one token per person, narrowed at each boundary so that each source sees only what it needs, and every call leaves an audit line. Our design test is simple: connecting a new source should take a registry entry, not platform code.

You also work on the knowledge sources themselves: indexing, semantic search and the curation pipelines that keep content findable and clean.

How You Will Make an Impact

• Build and operate the identity broker, the gateway and the MCP composer on Azure Kubernetes Service.
• Implement OAuth 2.0 and OIDC flows with Keycloak, federated to Entra ID, including token exchange (RFC 8693) and per-source permissions.
• Connect new knowledge sources and business systems as MCP servers and help their teams onboard on their own.
• Build semantic search and indexing on PostgreSQL with pgvector, and improve ranking over skills, experiences and documents.
• Secure the MCP layer against tool poisoning and toxic flows between sources, and control token cost with budgets and rate limits per client.
• Run everything as code: infrastructure in Bicep, deployments through GitLab CI and Argo CD, realm configuration and access policies in Git.
• Own production readiness together with security and operations: audit, monitoring, load tests and autoscaling.
• Reduce the single-operator risk by documenting, automating and sharing operations knowledge.

What Is Important to Us

• At least five years of professional software engineering, including running production services on a cloud platform.
• Strong Java and Spring skills; experience with Spring Cloud Gateway is a plus.
• Solid knowledge of OAuth 2.0 and OIDC, ideally with Keycloak and Entra ID. Experience with token exchange is a strong plus.
• Hands-on experience with Kubernetes and Azure (AKS, PostgreSQL, Key Vault, Front Door, Container Registry).
• Infrastructure as code and GitOps experience, for example Bicep, GitLab CI and Argo CD.
• Experience with the Model Context Protocol (MCP) or a strong interest in building MCP servers, including their security risks such as tool poisoning.
• Familiarity with agent frameworks such as Claude Agent SDK, Azure AI Foundry or LangGraph, whose agents are the clients of the platform, is a plus.
• Experience with search and retrieval, for example embeddings, pgvector or similar vector search.
• Observability and testing practice: Application Insights or similar, LLM tracing with Langfuse or similar, load tests with k6 or similar.
• You use AI coding agents in your daily work and can judge where AI-generated code needs extra review, especially in the identity path.
• Working knowledge of responsible AI and AI governance, for example the EU AI Act obligations on logging and human oversight.
• A security-first mindset and the discipline to keep a platform simple.
• Good communication skills and the ability to work with source owners, security and operations.
• You communicate confidently in English and work effectively in an international environment.

If you feel you don't meet all the requirements, we are still happy to get to know you, learn more about your ambitions and ideas and look forward to receiving your application!

We welcome people from all backgrounds, regardless of their gender, personality, national origin, race, religion, colour, sexual orientation, gender identity, age, marital status, disability or veteran status.