Company: Unilink Transportation

Time zone: You'll work US Central hours.

Engagement: Full-time employee / ON SITE POSITION / SAN PEDRO GARZA GARCIA NL

Reports to: CIO

ABOUT THE ROLE

We've decided to run our own AI, and we mean all of it. That means our own hardware in our own datacenter, with nothing going out to OpenAI, Anthropic, Google or anyone else. Our data stays with us, it never ends up in someone else's training set.

We need one experienced person to make this happen. You'll design it, build it, lock it down and run it in production. Then you'll write things up well enough that our IT team can keep it running without calling you. This isn't an advisory role. You'll rack the server, write the Ansible, tune vLLM and ship the agent platform yourself. A part-time DevOps/security engineer will join you for the network and hardening work, and you'll set their priorities.

There are three pieces to the job:

1. Stand up a private LLM platform on a new Lenovo GPU server with six NVIDIA RTX PRO 6000 Blackwell cards (576 GB of VRAM, with room for two more cards later).
2. Build our own autonomous agent platform, similar to Manus. Someone on our team describes what they need in plain English. The agent makes a plan, uses a browser, runs code, works with files and talks to our internal systems inside a safe sandbox. Then it hands back a finished report, spreadsheet, script or completed workflow.
3. Move our existing internal apps (about 20 of them) off outside AI APIs and off the GPU server we currently rent, onto our own internal endpoints.

WHAT YOU'LL BE WORKING WITH

Here's the AI we already run today. It's what you'll inherit and migrate:

- A finance and treasury analytics app where people ask questions in plain language.
- An operations analytics hub with its own AI analyst.
- An email assistant that sorts, drafts and summarizes mail for more than 70 mailboxes. It runs Mistral Small 24B on vLLM on a rented 24 GB GPU, and falls back to an external API when it needs to.
- A Microsoft Teams bot that lets staff ask the finance and operations AI questions in chat.
- A support assistant that answers IT questions from our ticketing knowledge base, with sources (pgvector embeddings).
- Playwright agents that work in our customers' freight portals, and an AI-driven sales outreach agent.
- Data sources: a PostgreSQL datalake on Aiven, McLeod TMS, Microsoft 365 and Entra ID, n8n workflows, Pipedrive and our own REST APIs.
- The rest of the stack: Next.js and TypeScript, Node.js, Python (FastAPI and Flask), PostgreSQL, Docker and systemd, with apps hosted on Vercel, Render and our own Linux servers.

WHAT YOU'LL DO

Leading the program

- Own the plan from start to finish. That covers the architecture, milestones, approval gates, risks and regular updates to leadership.
- Write the architecture and security design, plus a sizing report for the hardware, and get both signed off before the build starts.
- Point the part-time DevOps/security engineer at the right work, and keep our IT, network and app teams in the loop.
- Keep a list of every component and model we use, along with its license, so we know we're allowed to use all of it commercially.

1. Bringing up the GPU server

- Install Ubuntu, the NVIDIA drivers, CUDA, Docker with the NVIDIA Container Toolkit, and the systemd services everything runs under.
- Set up monitoring and alerts (Prometheus, Grafana, OpenTelemetry and GPU dashboards). Also set up backups, and actually test a restore.
- Come to San Antonio for the physical install, check power and network, and be there for first boot.

2. Serving the models

- Pick, install and tune open-weight models such as Qwen3, Mistral and Llama, using vLLM or SGLang. Use Ollama or llama.cpp where they make more sense.



Open to other models - must prove customization experience.
- Spread large models across several GPUs, quantize them (AWQ, GPTQ, FP8, NVFP4) and run several models side by side without them fighting over memory.
- Put an OpenAI-compatible gateway in front of everything. It should let us pick the right model for each kind of task and swap models without downtime. An outside API is only ever used if we switch that on.
- Meet clear targets for concurrent users, time to first token and throughput.

3. Fine-tuning, search and evaluation

- Fine-tune models on our own data with LoRA or QLoRA, but only where it clearly helps.
- Build the embedding and vector search pipelines so models can answer from our own documents and show where each answer came from.
- Build a set of test tasks taken from our real work, and measure honestly how well the system does against our goals.

4. Building the agent platform

- Start from open-source projects like OpenManus, AI Manus or OpenHands where their licenses allow, or build from scratch if that's the better call.
- The agent should show its plan, work through it step by step, change course when something fails, and ask the user when it's stuck.
- Give each task its own throwaway sandbox (a container or micro-VM using gVisor, Kata or Firecracker) with a shell, Python, Node and a file system. When the task is done, the sandbox gets deleted or archived.
- Run a real Chromium browser inside the sandbox. Users can watch it live and take over if they want.
- Let the agent write and run code, install packages from our internal mirror, crunch spreadsheets, draw charts and produce files people can download (Word, Excel, PowerPoint, PDF, Markdown, HTML and code).
- Let it search the web through a provider we choose, and search our own documents too.
- Connect it to our ERP/TMS, CRM, ticketing, email and databases through MCP servers and REST connectors, with permissions set per tool.
- Build a simple web app where people can follow the plan, the steps, the browser and the output files, look back through old tasks and share them with colleagues.
- Add memory for each person and team, reusable task templates, scheduled tasks, and a documented API so our other apps can hand work to the agent.
- Make sure tasks survive restarts and can pick up where they left off. Each task also needs limits on time, tokens and compute.

5. Environments and deployment

- Set up separate sandbox, staging and production environments, with a clear process for promoting models and settings from one to the next.
- Define everything as code (Ansible, Helm and/or Terraform). Run the sandboxes and services on Kubernetes or something equivalent we agree on.
- Keep all storage in house (object storage, PostgreSQL and a vector database), and back all of it up.

6. Security and privacy (built in from day one, not bolted on at the end)

- The inference servers get no internet access at all. Agent sandboxes only get out through a proxy that logs everything and follows allow and deny lists. Whether the agent can browse the internet at all is a switch we control.
- Sign-in through Microsoft Entra ID / Active Directory (OIDC or SAML), with role-based access.
- Keep secrets in a vault such as HashiCorp Vault and inject them only when a call needs them. The model never sees credentials, and they never land in a sandbox.




- Treat anything that comes from a web page, a file or an email as untrusted. That's our main defense against prompt injection.
- Encrypt data in transit and at rest, keep each user's data separate, and put clear retention and deletion rules in place.
- Keep a tamper-proof log of every task, tool call, command, URL and file, and make it possible to send it to a SIEM.
- Have the sandbox, the proxy and the login flow security-reviewed and penetration-tested before launch, and fix whatever turns up.

7. Migrating our existing apps

- Move our current AI apps onto the new internal endpoints one at a time. For each one, compare quality and keep a way to roll back.
- Once everything has moved, shut down the rented GPU server and retire the outside API keys.

8. Handing over and running it

- Write the runbooks our admins will rely on: deploying, upgrading, scaling, backup and restore, swapping a model and handling incidents. Also write a plain guide for everyday users.
- Train our IT team and our first group of users.
- Support the platform after launch, and keep owning it from then on.

WHAT SUCCESS LOOKS LIKE AFTER 6 MONTHS

- Staging and production run entirely in our datacenter, and they keep working with the internet unplugged.
- Every existing AI app has moved over, we've stopped paying for outside AI APIs, and the rented GPU is gone.
- The agent finishes [X]% of our [N] test tasks start to finish without anyone stepping in, and it handles [N] sessions at once.
- We can see exactly what the agent did, for any user and any task.
- Our IT team can deploy, update, scale, monitor and swap models from your runbooks without needing you.

WHAT WE'RE LOOKING FOR

- 7+ years in infrastructure, platform or backend engineering, with at least 3 of those years spent hands-on with ML or LLM systems in production.
- You've self-hosted open-weight LLMs on multi-GPU NVIDIA servers using vLLM, SGLang, TGI or similar, including tensor parallelism, quantization and performance tuning.
- You've shipped at least one real LLM agent that uses tools, and you can show us a demo or put us in touch with a reference.
- You know Linux well: Ubuntu, NVIDIA drivers and CUDA, Docker, systemd, networking and storage.
- You've run Kubernetes, and you know how to safely run code you don't trust (gVisor, Kata, Firecracker or similar).
- You've done browser automation with Playwright, Puppeteer, Browser Use or something like it.
- You write solid Python and/or TypeScript, and you can put together a decent web UI.
- You understand security for multi-user systems, including SSO/OIDC, RBAC, network segmentation, egress control, secrets and audit logging.
- You've built RAG pipelines with embeddings and a vector database (pgvector or similar).
- You use infrastructure as code (Ansible, Terraform and/or Helm) and CI/CD as a matter of habit.
- You've led a technical project from start to finish. That means planning, writing the design, managing risk, and explaining progress to people who aren't engineers.
- You write clear English. Whoever comes after you will depend on your docs.
- You can travel to San Antonio, TX when needed.

NICE TO HAVE

- You've contributed to, or run in production, OpenManus, OpenHands, AI Manus or a similar agent framework.
- You've built MCP (Model Context Protocol) servers or integrated with enterprise systems.
- You've fine-tuned models with LoRA or QLoRA using PyTorch and Hugging Face.
- You've worked in on-premises or air-gapped environments, and you've racked GPU servers from Lenovo, Dell, Supermicro or HPE yourself.
- You've worked with Microsoft 365, Entra ID, Microsoft Graph or Teams bots.
- You know your way around ISO 27001 or SOC 2 controls.
- You've worked in logistics or transportation, or with a TMS like McLeod.

📌 Senior Private AI Platform Lead (MLOps / AI Infrastructure & Agent Systems) (Monterrey)
🏢 Unilink Transportation
📍 Monterrey