Infrastructure Security Engineer, Kubernetes

• Design RBAC for people, service accounts and outside developers, with each tenant scoped to its own namespaces.
• Write admission policies with ValidatingAdmissionPolicy, Kyverno or OPA Gatekeeper, so workloads that break policy are rejected before they start.
• Enforce Pod Security Standards. Block privileged pods and host access, and use read-only filesystems where possible.
• Secure the software supply chain, so every image is built in CI, scanned, signed and pinned by digest.
• Manage secrets with Sealed Secrets, External Secrets or Vault, with rotation and audit.
• Harden the servers under the clusters: SSH and VPN access, BMC and firmware settings, and the identity provider and certificates they rely on.
• Write and run access, admission and network tests for tenant isolation, and re-run them after each platform change.
• Track security advisories for the platform's components, and roll out patches through the normal change path.

• 3+ years in security or platform engineering, with Kubernetes in production.
• Deep knowledge of Kubernetes RBAC, admission control, network policy and pod security.
• Container image scanning, signing and CI hardening.
• Identity basics: OIDC, service accounts and workload identity.
• Scripting in Go or Python.
• Clear writing for threat models and reviews.

• CKS.
• Runtime detection with Falco or Tetragon.
• SPIFFE/SPIRE.
• Sigstore cosign and SLSA provenance.

$123,000 to $190,000 a year

Full-time W-2 employment with health insurance, a retirement plan and paid leave.

No application deadline. We accept applications for this role on an ongoing basis.

Remote, United States