Staff Site Reliability Engineer (SRE)

Description

The company protects data so people can share it safely, without giving up security, privacy, or control. It offers data protection applications and an open platform built around the Trusted Data Format (TDF) open standard.

The company is backed by Iconiq Capital, Bessemer Venture Partners, Foundry Capital, and Tiger Global, and serves Fortune 500 companies and government agencies.

The platform is designed to work like Android for data protection: an open core that developers and partners can extend, plus the company's own applications built on it.

Responsibilities

• Own how the Data Security Platform is packaged, installed, upgraded, and validated in environments the company does not operate.
• Write the criteria a release must meet before it can ship to a customer, and be the go-to authority on whether an environment is ready for a release.
• Build the air-gapped delivery path from start to finish: offline bundles, mirrored registries, signed artifacts with a software bill of materials, and upgrades that run with no egress, no shell access, and no telemetry returned.
• Work with QA to build a reproducible test fleet and deployment test harness that checks releases across the Kubernetes distributions, identity providers, and version states customers run. The published compatibility matrix should come out of this work automatically.
• Set up an infrastructure-as-code baseline for a standard deployment so every install and upgrade starts from a known state.
• Instrument deployments to measure time to value, upgrade lag, first-time-right rate, and cost per deployment, and pass this data to the Operations partners.
• Design for disconnected operation from the start. Where automated telemetry is hard or prohibited, each collector needs a mode in which a person reviews a local file and decides whether to release it.
• Turn what you learn on each engagement into a reusable accelerator rather than another runbook.
• Work with Platform Engineering on the build and release pipeline. They own the pipeline; you own the criteria it enforces.
• Feed field findings into product decisions and record the outcome, so the same kind of deployment failure does not happen twice.
• Lead on difficult customer deployment escalations and turn each one into lasting automation, tooling, or a product ticket instead of tribal knowledge.
• Set the technical bar for future engineers and help define what good SRE practice looks like across the organization.
• Mentor and develop junior engineers and encourage a DevOps-first mindset across the organization.

Requirements

• Experience shipping software into environments you cannot reach directly, such as air-gapped, disconnected, or customer-controlled systems with no egress and no shell access.
• Hands-on experience building an offline install bundle and a working upgrade path for those environments.
• Experience with Kubernetes across distributions, such as EKS, OpenShift, RKE2, k3s, or equivalents, including real Helm packaging work and an understanding of how the same application fails differently on each.
• Experience with infrastructure as code and reproducible environments, using tools such as Terraform, OpenTofu, CloudFormation, or Ansible, and the ability to build on demand a fleet that matches a customer's exact mix of distribution, identity provider, and version.
• Nice to have: Argo CD or GitOps at scale.
• Nice to have: Windows Server, PowerShell, and MSI or MSIX packaging with code signing. Many customer end-user environments are Windows-heavy, and some policy enforcement points run on Windows client endpoints. Preferred, not required.
• Nice to have: Go proficiency. The Data Security Platform and OpenTDF are written in Go.
• Nice to have: operational depth in Keycloak, OIDC, and SAML, particularly with identity providers other than Keycloak.
• Nice to have: federal compliance and software supply-chain tooling, such as STIG and OpenSCAP, SBOM generation, and artifact signing with Sigstore or an equivalent.
• Nice to have: hands-on experience with Zarf, Hauler, oc-mirror, or troubleshoot.sh. The company may adopt mature tooling here rather than rebuild it, so direct experience moves you up the list.
• Nice to have: Podman and systemd-based container deployment for customers who will never run Kubernetes.
• Nice to have: familiarity with Zero Trust architecture and concepts such as Policy Enforcement and Decision Points, cryptography, attribute-based access control (ABAC), and identity.
• Nice to have, not required: an existing TS/SCI US security clearance, or eligibility to be submitted for one.
• Dealbreakers: a career spent only in infrastructure you control. If every system you have shipped runs in your own cloud account, this role may not suit you.
• Dealbreakers: depending on shell access and live dashboards to debug. In the hardest environments, a customer may email a file and join a phone call, and that may be the whole diagnostic surface.
• Dealbreakers: tolerating recurring toil without automating it. If your fix for repeated toil is a better runbook rather than software, this is not a fit.
• Dealbreakers: difficulty building trust with partners and customers. You may need to explain to a skeptical government security team why an install is safe, or to an internal VP of Engineering why critical platform work comes first. You need to be willing and eager to have those conversations.
• Qualities that will help you succeed: challenging teammates and managers respectfully and creatively in pursuit of excellence; urgency with an action-oriented approach; collaborating well and adapting when priorities shift; comfort with asynchronous communication such as Slack, email, and Zoom.

Conditions

Staff Site Reliability Engineer in the Delivery Engineering organization, on a small, autonomous team where everyone makes high-judgement, fast decisions independently.

The role supports the company, partner, and customer deployments across commercial enterprises, the Department of Defense, the Intelligence Community, Law Enforcement, and Federal Civilian agencies. Some of these environments have no internet access.

You will work directly with deployment engineers and forward deployed engineers, and influence product engineering roadmaps for deployment reliability.

You will work alongside a Principal Software Development Engineer, who owns the engineering standard and reusable-asset architecture for Delivery Engineering. You own the delivery path built on it.

The role uses AI-native design patterns to increase velocity without lowering quality or security standards.

Equal opportunity statement: the company welcomes applicants of all backgrounds.

Benefits

• Flexible PTO, with a strong encouragement to take time off, plus 14 holidays.
• $1,500 annual Learning & Development stipend.
• Company-sponsored team celebrations.
• Employee Assistance Program.
• Headspace mental health app access.
• Flat 3% retirement account contribution.
• Flexible time for appointments, errands, and family matters.
• Diversity, equity, inclusion, and belonging council.
• Competitive compensation.
• Generous parental, medical, and bereavement policies.
• 401K contribution and stock options.
• Full medical, dental, and vision coverage.
• New hire swag and IT welcome boxes.
• Structured semi-annual 360° performance reviews.