Senior DevOps Engineer

Why this role matters now

SpartanX is building the autonomous offensive security platform: hundreds of AI agents that attack a customer's web, API, network, cloud, identity and AI surfaces the way a real adversary would, continuously and at scale. We are a product company, not a services firm, and the product is the business.

That creates an infrastructure problem few teams in the world have to solve. Our workloads are offensive by design. They run exploits, open connections to targets, coordinate with each other and sometimes execute inside customer environments we do not control. Every one of them has to be isolated, governed and observable, and the platform has to keep shipping fast while engineering doubles.

This is not a “keep the pipelines green” role. You will design how we contain software whose purpose is to be offensive.

Your mission

Own the security and reliability of the SpartanX platform's runtime: how agents are isolated, what they can reach, how they are deployed in the cloud and on-prem, and how we prove all of it to customers and auditors. Do it with automation that moves fast without leaving security debt behind.

What you will own

Agent isolation and execution

• • Design and operate the sandboxed runtimes where offensive agents execute, choosing the right isolation level (containers, gVisor, Kata, Firecracker) for each workload.
• • Define and enforce the blast radius of every agent and every multi-agent mission, so a compromised or misbehaving agent cannot move laterally, persist or exfiltrate.

Egress control and network policy

• • Build and evolve our egress interception and enforcement layer: fine-grained, policy-driven control over every outbound connection an agent makes, so testing stays inside the authorized scope.
• • Own network policy across clusters, including mTLS between services and the PKI behind it.

On-prem and restricted deployments

• • Deliver and support SpartanX components inside customer networks that are restricted or hostile by nature: reverse tunnels, relays, NAT traversal and a minimal footprint.
• • Make those deployments easy to install, easy to audit and safe to remove.

Platform, CI/CD and supply chain

• • Own our Kubernetes platform, Infrastructure as Code and GitOps workflows end to end.
• • Build secure pipelines with integrated security gates, signed artifacts and verifiable provenance.
• • Manage secrets, certificates and their rotation, with no long-lived credentials left lying around.

Observability, detection and compliance

• • Instrument the platform for security, not only for performance: runtime telemetry, audit trails and detection for agent and infrastructure behavior.
• • Partner with Security and Compliance so our controls hold up to SOC 2 and enterprise customer security reviews, with evidence generated by the platform rather than by hand.

What you need to know

We are specific here on purpose. These are the foundations this role is built on. We do not expect perfect depth in every line, but we do expect strong command of the fundamentals and real hands-on experience across most of them.

Systems fundamentals

• • Linux in depth: namespaces, cgroups, capabilities, seccomp and the real permission model. Without this, everything about sandboxing and agent isolation is black magic.
• • Networking: TCP/IP, TLS/mTLS, DNS, routing, iptables/nftables and eBPF. Critical for egress interception, reverse tunnels and relays.
• • Applied cryptography: not inventing primitives, but truly understanding PKI, certificate rotation, mutual TLS, and signing and verification.

Containers and orchestration

• • Docker/OCI and alternative runtimes (gVisor, Kata Containers, Firecracker), and when each is the right tool for isolating the execution of offensive agents.
• • Kubernetes, not only operating it but understanding its security surface: NetworkPolicies, Pod Security Admission and Standards (PSA/PSS), admission controllers (OPA Gatekeeper, Kyverno), RBAC and service mesh.
• • Policy as code: OPA/Rego and Kyverno.

Security engineering

• • Threat modeling and attack surface analysis.
• • AppSec: SAST, DAST, SCA, dependency analysis and SBOM.
• • Secrets management: Vault, SOPS, Sealed Secrets, and rotation.
• • Supply chain security: artifact signing (Sigstore/cosign), SLSA and provenance.
• • Hardening of hosts, images and pipelines.
• • Detection and response: Falco, auditd and runtime telemetry.

CI/CD and automation

• • Secure pipelines: GitLab CI or GitHub Actions with integrated security gates.
• • Infrastructure as Code: Terraform/OpenTofu and Ansible, and scanning them (Checkov, tfsec, Trivy).
• • GitOps: Argo CD or Flux, with a focus on drift detection and policy enforcement.

Observability

• • Metrics, logs and traces: Prometheus, Grafana, OpenTelemetry and Loki.
• • Instrumenting for security, not only for performance.

Specific to the SpartanX platform

• • Isolating autonomous agents: how to contain something whose purpose is to be offensive, without it escaping or leaking.
• • Fine-grained egress control: interception and enforcement of outbound traffic policy.
• • Multi-agent architectures: reasoning about blast radius when several agents coordinate.
• • On-prem deployments in hostile or restricted environments: reverse tunnels, NAT traversal and a minimal footprint.

The cross-cutting skills (perhaps the most valuable)

• • An attacker's mindset applied to defense: you think about how what you build will break.
• • Automation without security debt: speed with judgment.
• • Explicit trade-offs: knowing when “secure enough” is the right answer, and saying so.
• • Communicating risk to non-technical people: founders, investors and customers.

Who you are

What you bring

• • 6+ years in DevOps, SRE, platform or infrastructure engineering, with at least 2 years owning security-sensitive production systems.
• • Production experience running Kubernetes at scale in at least one major cloud (AWS, GCP or Azure).
• • Hands-on depth in the fundamentals above: Linux internals, networking and applied cryptography.
• • A track record of building secure CI/CD, IaC and GitOps workflows from scratch, not only maintaining them.
• • Clear written English. In a distributed team, design docs and decisions are how we stay aligned.
• • Ownership. You see a risk, you raise it, and you fix it.

What will set you apart

• • Offensive security experience: penetration testing, red teaming, CTFs or vulnerability research.
• • Experience building sandboxes, multi-tenant isolation or untrusted code execution platforms.
• • eBPF programming, or building network proxies and interception layers.
• • Experience with GPU workloads or self-hosted model-serving infrastructure.
• • Experience operating in SOC 2 or similarly regulated environments.
• • Prior startup experience, especially building infrastructure from an early stage.

Read this before you apply

This role is not for everyone, and we would rather say so up front.

• • The workloads are hostile by design. The standard playbook assumes your software is trying to behave. Ours is trying to break things, on purpose, and you have to contain it.
• • There is no platform team behind you. You will design, build and operate. Decisions you make in your first months will shape the platform for years.
• • The bar is high. You will work alongside founders who have built and sold a security company before, and a research team that breaks into systems for a living. They will test what you build.
• • The pace is fast. AI is reshaping offensive security month by month, and the platform moves with it.

Why take it anyway. Few infrastructure roles anywhere involve containing autonomous offensive AI. You will solve problems that do not have a Stack Overflow answer yet, with the ownership and equity of an early team member.