About the company
This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Systems Engineer — Linux Isolation & Networking based in Canada.
Responsibilities
- Build and operate secure infrastructure for process isolation, sandboxing, workload execution, and network interception across multi-tenant environments.
- Develop transparent sidecar proxy capabilities that intercept outbound API traffic, enforce credential and compliance policies, and generate tamper-evident audit records.
- Implement Linux-based process isolation using users and permissions, namespaces, cgroups, ptrace restrictions, protected memory, and secure credential-handling practices.
- Evaluate and integrate sandboxing technologies such as gVisor, Firecracker, WebAssembly runtimes, and Unix-domain-socket isolation.
- Design mechanisms that reliably enforce workload and customer boundaries across large numbers of isolated execution environments.
- Evaluate and implement workload identity and attestation technologies, including SPIFFE and SPIRE.
- Build secure workload startup and initialization flows covering KMS access, token preparation, network-rule configuration, and readiness signaling.
- Improve the performance, observability, reliability, and failure recovery of execution and isolation infrastructure.
- Partner with Platform, Security, and Backend Engineering teams to define technical interfaces, troubleshoot production issues, and deploy infrastructure improvements.
Requirements
- Professional experience developing production-grade systems software using Go, Rust, C, or C++.
- Strong understanding of Linux internals, including namespaces, cgroups, netfilter or iptables, sockets, and process lifecycle management.
- Hands-on experience implementing or operating sandboxing or workload-isolation technologies such as gVisor, Firecracker, WebAssembly, containers, or micro virtual machines.
- Experience building networking infrastructure involving TCP/IP, transparent proxying, TLS termination, or TLS origination.
- Practical experience with process isolation, privilege separation, protected credential handling, or related operating-system security controls.
- Experience with multi-tenant container, sandbox, or virtual-machine isolation infrastructure is highly valued.
- Familiarity with workload identity and attestation frameworks such as SPIFFE or SPIRE is a plus.
- Experience with cloud key-management services such as AWS KMS, Azure Key Vault, or Google Cloud KMS is desirable.
- Background in endpoint security, EDR, zero-trust networking, infrastructure security, Kubernetes, container runtimes, or managed container platforms is advantageous.
- Experience with Temporal or another durable workflow execution platform is a plus.
- Strong analytical, troubleshooting, and collaboration skills, with the ability to work effectively across infrastructure, security, and backend teams.
Conditions
- Base salary range of CAD $160,000–$240,000 per year for the Toronto position.
- Full-time employment with opportunities to work on advanced Linux, networking, cloud, and security infrastructure.
- Additional benefits and rewards may be available depending on the role and individual impact.
- Potential eligibility for additional incentive compensation, depending on the applicable role and plan.
- Opportunity to work with cutting-edge technologies in a high-growth, high-performance environment.
- Collaboration with multidisciplinary Platform, Security, and Backend Engineering teams.
- Professional growth opportunities in systems engineering, cloud infrastructure, and cybersecurity.
- Inclusive workplace committed to equal employment opportunity and a diverse workforce.