DevSecOps Engineer

This is our first dedicated platform engineering hire. The product is built; the deployment story is not. Reporting directly to the CTO, you will own how Trident is installed, operated, and updated inside fully air-gapped environments, building bare-metal Kubernetes clusters from scratch, carrying every dependency offline, and defining the release and sign-off process that does not exist today. You will work closely with QA and a senior engineer, and you are expected to argue the platform and reliability point of view when it matters.

Responsibilities:

• Architect and operate bare-metal Kubernetes clusters across isolated security zones with zero external dependencies.
• Build the offline software supply chain: internal container registry, artifact repository, and curated language and OS package mirrors.
• Automate provisioning and configuration using Terraform, Ansible, and PXE-based bare-metal pipelines.
• Design multi-cluster deployment scripts and repeatable release procedures for our microservices platform.
• Establish sign-off, patching, and offline transfer procedures together with QA and engineering.
• Stand up self-hosted observability, metrics, logs, tracing, and alerting across multiple isolated sites.
• Harden RHEL and Ubuntu systems, manage internal PKI and secrets, and support security reviews.
• Travel occasionally to nearby deployment sites for installation and commissioning.
• Champion the platform and reliability viewpoint in architecture discussions with the CTO and senior engineers.

Requirements:

• Minimum 5 years in DevOps, infrastructure, or platform engineering, with recent senior or lead-level ownership.
• Hands-on experience deploying in on-premises, bare-metal, or disconnected environments, not cloud-managed services alone.
• Kubernetes was built and operated from scratch, including CNI, ingress, storage, and cluster upgrades.
• Terraform and configuration management (Ansible or equivalent) used in production.
• Self-hosted CI/CD and artifact management such as GitLab or Jenkins with Nexus, Artifactory, or Harbor.
• Linux systems depth: systemd, networking, storage, hardening, and production troubleshooting.
• Strong communication and stakeholder-management skills: you will work directly with QA, senior engineers, and the CTO.

Good-to-Have:

• Exposure to classified, defense, or otherwise airgapped programs.
• VMware vSphere, Proxmox, or KVM virtualization at scale.
• Self-hosted observability with Prometheus, Thanos, Grafana, Loki, or ELK.
• HashiCorp Vault, internal PKI, SELinux, or STIG-style hardening.
• Python, Go, or Bash tooling and RPM or DEB packaging.