Senior DevOps Engineer (B2B)

We build a Zero Trust Network Access platform for companies that have outgrown the corporate VPN. Our customers are security and IT teams who need every access request from every user and every device to be authenticated, authorized against policy, and recorded — with no implicit trust granted by network location.
We are looking for an experienced Senior DevOps Engineer who thrives on solving complex challenges and is ready to make a massive impact on a high-traffic product at the intersection of security, massive scale, and digital freedom.

About the role:

• Infrastructure architecture — design and evolution of the platform: K8s clusters, GitOps, networking, secrets, observability, VPN data plane. Technology choices and trade-off analysis, multi-region topology, migration planning.
• Routing architecture of the VPN data plane — design and operation of the dynamic routing layer: BGP / OSPF on FRR, route propagation between regions and gateways, policy-based routing and multiple routing tables, failover and traffic-steering scenarios.
• Complex infrastructure tasks — work that isn't delegated: debugging network connectivity and VPN routing, scaling, disaster recovery, designing egress / site-to-site / edge topologies, non-standard networking scenarios
• Build & software delivery — CI/CD pipelines, container image builds, and delivery to environments (dev/stage/prod) via GitOps. Application source code is owned by the respective backend and frontend team leads; this role owns the build and delivery mechanism (and all infrastructure beneath it), not the application code itself.
• Mentoring & code review — reviewing infrastructure code, mentoring junior DevOps engineers, helping distribute and unblock their work.

What we are looking for:

Dynamic routing & Policy-Based Routing on Linux (must have)

• FRRouting (FRR) — production experience: zebra / bgpd / ospfd, vtysh, config management and version control of routing configs, upgrades, troubleshooting adjacencies and route installation into the kernel.
• BGP — eBGP / iBGP peering, route-maps, prefix-lists, communities, AS-path filtering, next-hop handling, ECMP / multipath, BFD, graceful restart; announcing service and gateway prefixes (incl. anycast-style edge setups).
• OSPF — areas and cost/metric design, adjacency and LSA troubleshooting, redistribution between OSPF and BGP, interaction with tunnel interfaces.
• Policy-Based Routing (PBR) — ip rule + multiple custom routing tables, source-based and fwmark-based routing (nftables / iptables marking), VRF-style routing and network-namespace isolation, multi-uplink egress selection.
• Routing diagnostics — ip route get, ip -6, tcpdump, ss, mtr / traceroute; debugging asymmetric routing, route leaks, MTU / MSS and blackholing issues across tunnels.

Networking & VPN data-plane expertise (critical)

• VPN protocols: current — OpenVPN (with obfuscation), XRay, IKEv2 / IPsec; future — AmneziaWG / WireGuard and similar
• RADIUS / RadSec (RADIUS-over-TLS), FreeRADIUS, StrongSwan / IPsec
• Linux networking — TCP/IP, TLS, NAT / MASQUERADE (nftables / iptables), tun/tap, kernel routing

Kubernetes & orchestration

• Strong production experience with Kubernetes — managed clusters, multi-cluster setups
• Helm — authoring shared chart libraries, dependency management, per-environment value overlays
• Harbor (or equivalent container registry)

GitOps & CI/CD

• ArgoCD — ApplicationSets, AppProjects, multi-cluster deployments, sync policies / sync windows
• GitLab CI — pipelines, multi-project triggers, reusable templates
• Owning the image-build and software-delivery process across environments

IaC & provisioning

• Terraform — provisioning across public clouds and virtualization platforms: OVH, AWS, Yandex Cloud, Proxmox
• Ansible — configuration management and server provisioning

Secrets

• Infisical (or Vault / equivalent)
• External Secrets Operator

Stateful services (K8s operators)

• CloudNativePG (PostgreSQL) — clusters, backups, WAL / PITR
• RabbitMQ Cluster Operator
• Redis (ot-container-kit)
• Centrifugo (realtime messaging)

Networking, Ingress, TLS, DNS

• Traefik — IngressRoute / IngressRouteTCP, split-LB
• cert-manager — Let's Encrypt (DNS-01)
• external-dns, Cloudflare
• CoreDNS (split-horizon), PowerDNS
• Stakater Reflector

Observability

• Prometheus / kube-prometheus-stack, Grafana, Loki, Alloy, Alertmanager

Programming (infrastructure microservices & automation)

• Go — network gateway services (PBR / NAT / firewall, DNS reconciler)
• Bash, Python

Nice to Have:

• Experience with security systems that inspect network traffic for malicious code — IDS / IPS, DPI (e.g., Suricata, Snort, Zeek).
• Route-server / IXP peering experience, RPKI / route-origin validation.
• Experience automating FRR configuration (templating, reconciliation, config drift detection).

What We Offer:

• Build personal AI agents using our premium infrastructure.
• Internal R&D opportunities.
• Paid time off and sick leave.
• Direct impact on a massive, world-class B2B product.
• A collaborative environment with some of the best minds.
• Hardware upon completion of your probation.