This is the end-to-end system design question. A Principal Platform Engineer owns this entire picture.

# Foundation: Org hierarchy via Cloud Foundation Toolkit (Terraform)

# Identity: Workload Identity everywhere, OS Login for VMs, no SA keys

# Networking: Shared VPC + Cloud NAT + Private GKE + Cloud Interconnect

# Compute: GKE Autopilot for apps, Cloud Run for stateless APIs, Cloud SQL + Spanner for data

# CI/CD: Cloud Build + Artifact Registry + ArgoCD + Binary Authorization

# Observability: Cloud Monitoring + Cloud Logging + Cloud Trace + SLO alerting

# Security: VPC-SC + SCC + Org Policies + KMS + Secret Manager

# Cost: Billing export → BigQuery → Looker dashboards + team labels + CUDs

The Platform team's output is a paved road: developers deploy applications without knowing GCP internals. Golden paths (IaC modules, CI/CD templates, observability standards) make the right thing the easy thing. Platform team measures success by developer deployment frequency and MTTR — not by individual infrastructure components.

Interview framing: A Principal Platform Engineer at a security-focused company also owns the security posture of the platform itself. Tie every architectural decision back to: least privilege, auditability, data protection, and supply chain integrity. That combination — platform reliability + security-first thinking — is exactly what the role requires.