Principal Software Architect - Emerging Technologies

Granicus•Remote,

7d•$175,000 - $222,000•Remote

About The Position

Granicus is hiring a Principal Software Architect for its Office of the CTO to scale an established AI-native software development lifecycle across additional delivery teams. The model uses autonomous agents for high-confidence implementation work, while senior engineers orchestrate, review, and remain accountable for outcomes. The role sets and upholds engineering standards for this approach in a FedRAMP-authorized environment. The architect owns the generator-verifier architecture, agent orchestration patterns, eval-driven development discipline, and CI/CD system for high volumes of autonomous-agent pull requests. The security boundary includes in-VPC model inference through AWS Bedrock, including GovCloud, and sandboxed agent actions using WASM-isolated runtimes and encrypted credential storage. Compliance requirements—including NIST 800-53 Rev 5, WCAG, SOC 2, and applicable FedRAMP authorizations—are treated as engineering requirements enforced through architecture and pipeline guardrails. The role establishes standards inherited by delivery teams, including branching, review protocols, evaluation conventions, and staged deployment. It also defines how workstreams may progress from supervised to autonomous execution based on measured agent reliability. All agent-generated code must receive senior human review before merging to production; the responsible engineer retains accountability. The role is part of a remote-first company with a globally distributed workforce. Granicus describes its culture as transparent, inclusive, and safe, and offers a flexible benefits package to U.S.-based team members.

Requirements

Experience architecting systems at scale with accountability for outcomes, including distributed systems, CI/CD, and developer platforms with significant operational consequences.
Deep CI/CD and developer-platform expertise, including building reliable, performant pipelines for testing, staged deployment, rollback, and observability.
Hands-on experience operating LLM agents in production paths, including orchestration, tool use, sandboxing, evaluation, and failure modes at volume.
Security-architecture expertise in least-privilege design, secrets management, network boundary enforcement, and threat modeling, with work that withstands audit and adversarial review.
A track record of setting standards adopted by others, such as a branching model, review protocol, or platform pattern.
Ability to act as an accountability gate without becoming a bottleneck by designing high-signal, low-latency review tools and conventions.
Willingness to own engineering standards and accountability, and to prioritize demonstrable safety within a FedRAMP boundary.
Ability to decline requests for more autonomy than a workstream’s measured reliability supports.

Nice To Haves

Demonstrated experience designing and defending a security boundary in FedRAMP, FedRAMP High, defense, financial services, or healthcare, including direct formal-audit experience; high-assurance security architecture is strongly preferred.
Fluency in NIST 800-53 Rev 5, including mapping controls directly to engineering guardrails.
AWS Bedrock or GovCloud experience maintaining inference and data within a compliance boundary.
Experience with eval-driven development or generator-verifier architectures at a frontier-model or leading platform organization.

Responsibilities

Own the generator-verifier architecture, using generator agents and verifier agents, automated tests, evaluation suites, SAST/DAST, and policy checks to scale throughput without quality regression.
Define agent orchestration patterns, including task decomposition, dispatch, sandboxing, reassembly, secure state handling, and credential handling.
Build and operate CI/CD pipelines that triage, test, and route high volumes of agent-generated pull requests while keeping human review efficient and high-signal.
Establish eval-driven development by defining measurable acceptance criteria and validating changes against evaluation suites.
Own the security boundary, including in-VPC inference via AWS Bedrock and GovCloud, least-privilege agent permissions, and mapping NIST 800-53 Rev 5 controls to pipeline guardrails.
Serve as the final human accountability gate and enforce senior human review of agent-generated code before it reaches production.
Define engineering standards for branching, review protocols, evaluation conventions, and staged deployment, and maintain the reference implementation.
Govern graduated autonomy by defining criteria for workstreams to move from supervised to autonomous execution based on measured agent reliability.
Preserve the confidentiality, integrity, and availability of Granicus information assets in accordance with the company information security program.
Protect employee and customer data privacy and complete required privacy training in accordance with company policies.

Benefits

Flexible Time Off
Company-wide paid Wellbeing Days
Work From Home Reimbursement
Multiple health plan options, including a 100% employer-paid plan
Employer HSA contributions for employees enrolled in a High-Deductible Health Plan
Fitness reimbursement program
On-demand mental health support, including access to Headspace and other wellness tools
Paid parental leave for birthing and non-birthing parents
Traditional and Roth 401(k) with a company match
100% employer-paid Life and AD&D Insurance
Online learning platforms for professional development
Competitive salary and bonuses