Platform & Release Engineer (Fractional) — Sovereign AI Compliance Platform

Engagement: 1–2 days per week · business-to-business consulting agreement · non-exclusive · fully remote, France preferred · occasional travel to client sites across Europe, the Middle East, and Africa, the UK included · koruimpact.org

ABOUT KORU IMPACT

Koru Impact is an AI-native management consultancy and regulatory technology firm incorporated in the Qatar Financial Centre (Registration No. 04642). We advise regulated financial institutions on sustainability reporting readiness, AI and technology governance, and organizational resilience — and we build KDSA, a sovereign AI compliance platform that lets institutions prove human oversight of AI-assisted decisions to their regulators.

KDSA runs where the client's constraints put it: fully on-premises — including air-gapped estates with no internet access — hybrid, or managed sovereign cloud. Windows, Linux, or macOS. CPU, GPU, or NPU acceleration. The platform pairs an open-weight language model running locally with a deterministic rule engine and a cryptographically chained audit trail. Nothing leaves the client's jurisdiction, and the evidence the platform produces is the evidence regulators ask for. The deployment target is never our preference; it is the client's estate — and our job is to install cleanly, dependably, and repeatably into whatever that estate turns out to be.

We are a small, senior, distributed team. We operate an AI-assisted engineering pipeline under strict human gates — every release candidate is reviewed, tested against a deterministic regression suite of several hundred tests, and accepted by a named human authority before it ships. We are looking for the person who owns that shipping — everywhere it has to happen.

THE ROLE

You will be the firm's release authority — the engineer who owns how KDSA is built, verified, signed, packaged, and delivered, across every operating system, hardware class, and deployment tier a client can put in front of us. You are deliberately independent of feature authorship: you do not write the product's features; you make sure what ships is exactly what was verified — on a bank's air-gapped Linux cluster, a supervisor's managed cloud tenancy, or an executive's laptop. In a platform whose entire value is trustworthy evidence, the release chain is the product's credibility — and yours will double as audit evidence as the firm pursues internationally recognized management-system certification.

Your first milestone, stated plainly: a green build and the full deterministic test suite reproduced on a second machine — different hardware and, ideally, a different operating system from the reference unit. From there: a continuous-integration service, versioned and signed artifacts, installers and packages for each target platform, and an offline update path for environments with no internet access.

YOU WILL OWN

• Build and release engineering across Windows, Linux, and macOS targets — reproducible builds, versioned and signed artifacts, and a release cadence appropriate to regulated-industry buyers.
• Continuous integration from first pipeline to steady state — GitHub Actions, Azure DevOps, GitLab CI/CD, or equivalent. The tool is a choice; the discipline is not.
• Packaging across estates: native installers per operating system, and container images with Helm charts where the client's tier runs on Kubernetes.
• Artifact signing across ecosystems — Windows Authenticode, Apple notarization, signed Linux repositories, Sigstore/cosign for containers — so every estate can verify what it received.
• The offline and air-gapped delivery path — offline installers with verifiable signatures, mirrored registries, packaged transfers for disconnected clusters — designed and tested, not improvised.
• Stewardship of the deterministic regression test estate that gates every release on every platform.
• Review of AI-assisted release candidates: the independent second pair of eyes on code produced by our gated AI engineering pipeline. You verify; you never rubber-stamp.
• Dependency, license, and software-bill-of-materials hygiene — we keep a permissively licensed stack by policy, we know exactly what ships in every build, and the release chain proves it.

WHAT WE REQUIRE

• 10+ years in software, platform, or release engineering, with real ownership of shipping — not adjacency to it.
• Continuous-integration fluency on at least two services (GitHub Actions, Azure DevOps, GitLab CI/CD, Jenkins, or equivalent), built by you, not inherited.
• Cross-platform Python packaging and environment discipline — pinned dependencies, wheels, clean environments — on Windows, Linux, and macOS alike.
• Packaging and installer engineering on at least two operating‑system families, with willingness to own all three: Windows (MSI/MSIX via WiX, Inno Setup, or equivalent); macOS (signed .pkg/.dmg with Developer ID, hardened runtime, notarization, and ticket stapling so Gatekeeper validates offline); Linux (deb/rpm with signed repositories) — plus OCI container images and Helm charts.
• Artifact signing in at least two ecosystems, hands‑on: Authenticode with CA‑issued certificates or a managed signing service; Apple notarization; GPG‑signed repositories; Sigstore/cosign.
• Offline, restricted‑network, or air‑gapped delivery experience — for desktop targets and, ideally, disconnected Kubernetes clusters (registry mirroring; packaged‑transfer tooling such as Zarf is a genuine plus).
• Reproducible‑builds discipline: you can make two machines — on two operating systems — produce verifiably equivalent artifacts, and prove it.
• Deep git fluency and documentation‑forward habits: your runbooks let someone else operate your pipeline on a platform you never touched.

STRONGLY PREFERRED

• On‑device and server inference runtimes across vendors: ONNX Runtime and its execution‑provider families (OpenVINO, Qualcomm QNN, TensorRT‑class), OpenVINO on Intel CPU/GPU/NPU, Apple‑silicon paths (Metal‑based runtimes such as llama.cpp, or Core ML), NVIDIA CUDA/TensorRT, AMD ROCm. You do not need all of them; you need the habit of treating the accelerator as a deployment parameter, not an identity.
• Cloud delivery across providers — including sovereign and regional clouds — with infrastructure‑as‑code exposure and enough Kubernetes operations to ship into a client's cluster without owning it.
• Software bill of materials practice (CycloneDX or SPDX, generated in the pipeline, signed as an artifact) and familiarity with the supply‑chain expectations arriving in regulation — the EU Cyber Resilience Act's reporting obligations begin in September 2026.
• Release discipline from a regulated industry — financial services, medical devices, defense, or similar.
• Familiarity with ISO/IEC 27001 or ISO/IEC 42001 environments; an ISO/IEC 42001 Lead Implementer credential is a genuine plus, not a checkbox.
• Professional working proficiency in French is an asset — several of our client lanes are Francophone. Our working language is English.

DISPOSITION — THIS MATTERS AS MUCH AS THE STACK

• Evidence discipline. You want claims traceable to artifacts. "It works on my machine" offends you professionally — on any of the machines.
• Platform pluralism. No operating‑system allegiance, no vendor loyalty. The client's estate decides the target; your craft is making delivery equally trustworthy on all of them.
• Independence. You are comfortable being the gate — including telling the founder a release is not ready, with the test output to show why.
• Calm in ambiguity. This is a pre‑revenue firm entering its first pilots. A client's environment can reshape a delivery plan in a week; you re‑plan without drama.
• A portfolio professional's mindset. This engagement is fractional and non‑exclusive by design; we expect you to have other clients, and we contract accordingly.

ENGAGEMENT AND COMPENSATION — STATED HONESTLY

Koru is pre‑revenue. This engagement is compensated through a Deferred Revenue Royalty: a contractual share of the platform's commercial revenue over a five‑year term from its first commercial invoice, documented in a Build‑Phase Agreement — a business‑to‑business contract under Qatar Financial Centre law, compatible with contracting through your own French entity (SASU, EURL, or micro‑entreprise). There is no cash fee during the build phase; there is a defined, documented share of what the product earns, precisely because you joined before it earned anything. Full terms — royalty mechanics, term, leaver provisions, and what happens as revenue arrives — are shared openly in writing in the first conversation, before you commit anything. Hardware for a second, client‑representative build environment is provided.

WHY THIS ROLE, FOR THE RIGHT PERSON

• Release authority over a sovereign AI platform entering pilot with regulated financial institutions — a small surface, high stakes, and your name on the gate.
• A genuinely cross‑platform engineering problem: the same evidence guarantees on an air‑gapped cluster, a sovereign cloud tenancy, and a laptop.
• Your infrastructure becomes part of the firm's certification evidence: the release chain you build is what auditors will examine.
• Founding‑phase economics with a contractual, documented upside — not a promise, a signed royalty schedule.

Shortlisted candidates will be asked one question first: the hardest release, packaging, or build‑reproducibility problem you personally solved — ideally one that crossed operating systems or entered a disconnected environment — what broke, what you did, and how you proved it was fixed.

Koru Impact LLC is a secular, equal‑opportunity firm. We evaluate candidates on evidence.