Senior GCP Cloud Engineer (Contract, SC) - Kubernetes / GKE / Air-GappedTHE SHORT VERSIONA UK technology business building AI systems for regulated, security-sensitive environments is standing up a new data platform on Google Cloud, and needs someone to own the ground it runs on. GKE, infrastructure as code, CI/CD and observability, on a deliberately open-source stack with no managed-service shortcuts. You run it yourself rather than consuming managed equivalents. The interesting part is the topology: an edge cluster and a central cluster with replication between them, putting real weight on networking, inter-cluster connectivity and security posture.This is a GCP role end to end. If your depth is in Azure or AWS, this one won't be the right fit.THE ENGINEERING PROBLEMSplit topology. An edge cluster and a central cluster with replication between them. Getting that right is the defining challenge of the role.Constrained environments. Deployments into restricted, disconnected and high-classification networks, which changes almost every assumption you can normally make about connectivity and tooling.Security by design. Systems are under accreditation scrutiny, so hardening, network policy, secrets management and identity are design inputs rather than afterthoughts.WHERE YOU WOULD BE WORKINGA venture-backed UK scale-up building AI platforms for highly regulated and security-sensitive sectors, delivering across high-profile government and commercial programmes. Delivery-driven, highly autonomous engineering with small teams given real ownership. We are keeping the client name off this document; get in touch and we will tell you exactly who it is before you decide anything.WHAT THE JOB INVOLVESDesign, build and operate secure, resilient infrastructure on Google Cloud for regulated and air-gapped environments.Build and maintain Kubernetes clusters on GKE, including the split edge and central topology and the replication between them.Own infrastructure as code, CI/CD pipelines and automated, repeatable deployments.Implement observability, monitoring, alerting and incident response across distributed clusters using Prometheus, Grafana and Loki.Harden systems and embed the security controls needed for accreditation, covering network policy, secrets management and identity, and support deployments into restricted, disconnected and high-classification networks.WHAT YOU WILL NEEDStrong Google Cloud experience, GKE in particular. This is the core of the role, not a nice-to-have.Deep experience with containers and orchestration, Docker and Kubernetes, alongside strong Linux systems administration.Proven track record standing up and running production cloud infrastructure as a cloud, DevOps or SRE engineer.Infrastructure as code, whether Terraform, Ansible or equivalent, and CI/CD tooling such as GitLab CI, GitHub Actions or Jenkins.A solid understanding of secure, hardened deployments and network security, with instincts suited to an environment under accreditation scrutiny.SC clearance. Active clearance is strongly preferred for this contract; for the right person, genuine eligibility will be considered.WHAT WOULD HELPAir-gapped, on-premise or restricted-network deployments, and multi-cluster or geographically distributed architectures.Kubernetes networking and policy tooling such as Cilium and eBPF, and event streaming infrastructure, Kafka, ideally via Strimzi.Secrets management, PKI and identity using Vault or Keycloak; scripting in Python, Bash or Go; and a defence, government or regulated sector background.CONTRACT TERMS AND CLEARANCE£400 to £500 per day, depending on experience and clearance status. Active SC sits at the top of that range.Remote across the UK, with occasional travel as the programme requires. Duration and IR35 status confirmed on application.Read this carefully. SC eligibility requires a provable five-year UK address history. If you have lived outside the UK within that window, this will be difficult on this programme's timeline. A DBS check or BPSS clearance is not the same as SC.For a confidential conversation and the client name, emailTPBN1_UKTJ