We are looking for an experienced engineer to join a team responsible for securing the Kubernetes environment and virtualized infrastructure.
Your responsibilities will include:
- Implementing and maintaining Kubernetes security mechanisms: policy-as-code, PSS/PSA, securityContext, deviation control, and exception handling;
- Developing runtime security and security observability: event collection/analysis, detection rule configuration, false positive reduction, integrations with logging/alerting;
- Improving cluster network security: NetworkPolicies (Calico/Cilium), segmentation, ingress/egress control in collaboration with the platform team;
- Developing automation for Kubernetes security analytics: collecting data on configurations/policies/incidents, basic reports and dashboards, deviation detection;
- Implementing and supporting secret management in Kubernetes: secret handling practices, integrations with Vault/KMS/External Secrets, rotation and secure delivery of secrets to workloads;
- Conducting security architecture reviews and threat modeling for platform changes and infrastructure services, bringing changes to production environments;
- Automating routine tasks: GitOps/CI for configs and policies, policy testing, documentation, and runbooks.
Work format - remote.
You are a good fit for us if you have:
- Practical experience with Kubernetes: RBAC, ServiceAccounts, securityContext, Admission, Audit Logs, PSS/PSA, Control Plane hardening;
- Understanding of containers and Linux security at an application level;
- Experience with 1-2 domains: policy engines (Kyverno / OPA Gatekeeper), runtime monitoring/detection (Falco/Tetragon/Tracee or similar), NetworkPolicies (Calico/Cilium);
- Secret management experience: Vault/External Secrets/KMS, understanding rotation, access rights, secure delivery of secrets;
- Operations tools: Terraform/Ansible, Helm/Kustomize, GitOps (ArgoCD/Flux);
- Automation: Python/Go/Bash, writing integrations/utilities, working with K8s API, logs/metrics;
- Basic observability: Prometheus/Alertmanager/logging, ability to troubleshoot incidents and write clear runbooks.
