Virtru - Staff Site Reliability Engineer (SRE)

• You have shipped software into environments you could not reach. Air-gapped, disconnected, or otherwise customer-controlled, with no egress and no shell access. You have personally built an offline install bundle and a working upgrade path. • You have shipped software into environments you could not reach. • Have worked with Kubernetes across distributions. EKS, OpenShift, RKE2, k3s, or their equivalents, with real Helm packaging depth and a clear understanding of how the same application fails differently on each. • Have worked with Kubernetes across distributions. • You embrace Infrastructure as code and reproducible environments as a discipline. Terraform or OpenTofu, CloudFormation, Ansible, and the ability to stand up a fleet that reproduces a customer's specific combination of distribution, identity provider, and version state on demand. • You embrace Infrastructure as code and reproducible environments as a discipline. • Argo CD or GitOps at scale. • Windows Server, PowerShell, and MSI or MSIX packaging with code signing. Many of our customers' end-user environments are Windows-heavy and some of our policy enforcement points are deployed on Windows client endpoints. Preferred, not required. • Go proficiency, which is what the Data Security Platform and OpenTDF are written in. • Operational depth in Keycloak, OIDC, and SAML, and particularly in identity providers that are not Keycloak. • Federal compliance and software supply-chain tooling: STIG and OpenSCAP, SBOM generation, artifact signing with Sigstore or an equivalent. • Hands-on experience with Zarf, Hauler, oc-mirror, or troubleshoot.sh. We may adopt mature tooling in this space rather than rebuild it, so direct experience here moves you to the front of the line. • Podman and systemd-based container deployment, for the customers who will never run Kubernetes. • Familiarity with Zero Trust security architecture and concepts such as Policy Enforcement/Decision Points, cryptography, attribute-based access control (ABAC), and identity. • Existing TS/SCI US security clearance or eligible to be submitted for one. Not required for this role, but nice to have. • What are the dealbreakers? • A career spent entirely inside infrastructure you controlled. If every system you have shipped runs in your own cloud account, this role may not be for you. • A career spent entirely inside infrastructure you controlled. • Needing shell access and live dashboards to debug. In our hardest environments, a customer emails you a file and that coupled with a phone call may be the entire diagnostic surface. • Needing shell access and live dashboards to debug. • Enduring operational toil without automation. If your answer to recurring toil is a better runbook rather than software to automate it, this isn’t a fit. • Enduring operational toil without automation. • Inability to earn trust and credibility with partners and customers. You may be the person who has to explain to a skeptical government security team why our install is safe, or to an internal VP of Engineering why we need to prioritize critical platform features. Those have to be conversations you are willing and excited to have. • Inability to earn trust and credibility with partners and customers. • Virtruvian qualities that will set you up for success: • Thinking outside of the box to respectfully challenge your teammates and managers in the pursuit of excellence • Strong sense of urgency with an action-oriented mindset • Able to collaborate and adapt to shifting priorities as business needs evolve • Comfortable with asynchronous communication including slack, email, zoom, etc.