We are looking for an experienced Senior DevOps Engineer who thrives on solving complex challenges and is ready to make a massive impact on a high-traffic product at the intersection of security, massive scale, and digital freedom.
About the role:
Infrastructure architecture — design and evolution of the platform: K8s clusters, GitOps, networking, secrets, observability, VPN data plane. Technology choices and trade-off analysis, multi-region topology, migration planning.
Routing architecture of the VPN data plane — design and operation of the dynamic routing layer: BGP / OSPF on FRR, route propagation between regions and gateways, policy-based routing and multiple routing tables, failover and traffic-steering scenarios.
Complex infrastructure tasks — work that isn't delegated: debugging network connectivity and VPN routing, scaling, disaster recovery, designing egress / site-to-site / edge topologies, non-standard networking scenarios.
Build & software delivery — CI/CD pipelines, container image builds, and delivery to environments (dev/stage/prod) via GitOps. Application source code is owned by the respective backend and frontend team leads; this role owns the build and delivery mechanism (and all infrastructure beneath it), not the application code itself.
Mentoring & code review — reviewing infrastructure code, mentoring junior DevOps engineers, helping distribute and unblock their work.
What we are looking for:
- Dynamic routing & Policy-Based Routing on Linux (must have)
- FRRouting (FRR) — production experience: zebra / bgpd / ospfd, vtysh, config management and version control of routing configs, upgrades, troubleshooting adjacencies and route installation into the kernel.
- BGP — eBGP / iBGP peering, route-maps, prefix-lists, communities, AS-path filtering, next-hop handling, ECMP / multipath, BFD, graceful restart; announcing service and gateway prefixes (incl. anycast-style edge setups).
- OSPF — areas and cost/metric design, adjacency and LSA troubleshooting, redistribution between OSPF and BGP, interaction with tunnel interfaces.
- Policy-Based Routing (PBR) — ip rule + multiple custom routing tables, source-based and fwmark-based routing (nftables / iptables marking), VRF-style routing and network-namespace isolation, multi-uplink egress selection.
- Routing diagnostics — ip route get, ip -6, tcpdump, ss, mtr / traceroute; debugging asymmetric routing, route leaks, MTU / MSS and blackholing issues across tunnels.
- Networking & VPN data-plane expertise (critical)
- VPN protocols: current — OpenVPN (with obfuscation), XRay, IKEv2 / IPsec; future — AmneziaWG / WireGuard and similar.
- RADIUS / RadSec (RADIUS-over-TLS), FreeRADIUS, StrongSwan / IPsec.
- Linux networking — TCP/IP, TLS, NAT / MASQUERADE (nftables / iptables), tun/tap, kernel routing.
- Kubernetes & orchestration
- Strong production experience with Kubernetes — managed clusters, multi-cluster setups.
- Helm — authoring shared chart libraries, dependency management, per-environment value overlays.
- Harbor (or equivalent container registry).
- GitOps & CI/CD
- ArgoCD — ApplicationSets, AppProjects, multi-cluster deployments, sync policies / sync windows.
- GitLab CI — pipelines, multi-project triggers, reusable templates.
- Owning the image-build and software-delivery process across environments.
- IaC & provisioning
- Terraform — provisioning across public clouds and virtualization platforms: OVH, AWS, Yandex Cloud, Proxmox.
- Ansible — configuration management and server provisioning.
- Secrets
- Infisical (or Vault / equivalent).
- External Secrets Operator.
- Stateful services (K8s operators).
- CloudNativePG (PostgreSQL) — clusters, backups, WAL / PITR.
- RabbitMQ Cluster Operator.
- Redis (ot-container-kit).
- Centrifugo (realtime messaging).
- Networking, Ingress, TLS, DNS.
- Traefik — IngressRoute / IngressRouteTCP, split-LB.
- cert-manager — Let's Encrypt (DNS-01).
- external-dns, Cloudflare.
- CoreDNS (split-horizon), PowerDNS.
- Stakater Reflector.
- Observability
- Prometheus / kube-prometheus-stack, Grafana, Loki, Alloy, Alertmanager.
- Programming (infrastructure microservices & automation)
- Go — network gateway services (PBR / NAT / firewall, DNS reconciler).
- Bash, Python.
Nice to Have:
- Experience with security systems that inspect network traffic for malicious code — IDS / IPS, DPI (e.g., Suricata, Snort, Zeek).
- Route-server / IXP peering experience, RPKI / route-origin validation.
- Experience automating FRR configuration (templating, reconciliation, config drift detection).
What We Offer:
- Build personal AI agents using our premium infrastructure.
- Premium accounts for our products to keep your data protected.
- Internal R&D opportunities.
- Paid time off and sick leave.
- Direct impact on a massive, world-class B2B product.
- A collaborative environment with some of the best minds.
- Hardware upon completion of your probation.
