Description
We are seeking an infrastructure engineer with strong hands-on engineering skills and an infrastructure focus, supporting self-managed, dedicated and bare-metal infrastructure. This role is centred on self-managed, dedicated and bare-metal infrastructure rather than public cloud, with security responsibilities layered across encryption, key management and certificate lifecycle management.
Responsibilities
•Manage Ubuntu Linux servers in production, including systemd, logs, package management, processes and filesystems.
•Operate infrastructure with dedicated hosting providers such as Hetzner or OVH, or in colocation data centers such as Digital Realty/Interxion or Cyberlynk.
•Configure and debug routing, DNS, firewalls and VPNs.
•Work with physical servers, including diagnosing hardware failures.
•Assess the security implications of infrastructure changes, including patching vulnerabilities, enforcing access control and handling secrets.
•Troubleshoot issues with a focus on identifying root cause rather than symptoms.
•Plan infrastructure changes with an understanding of system interdependencies, avoiding disruption to production.
•Use scripting and configuration management tools such as Ansible.
•Use metrics, dashboards, alerts and logs to monitor and understand systems.
•Translate compliance requirements into practical infrastructure changes.
•Work closely with developers, raising questions early.
Requirements
•5+ years of experience, with strong hands-on engineering skills and an infrastructure focus.
•Hands-on experience managing Ubuntu Linux servers in production, including systemd, logs, package management, processes and filesystems.
•Experience operating infrastructure with dedicated hosting providers such as Hetzner or OVH, or in colocation data centers such as Digital Realty/Interxion or Cyberlynk.
•Strong understanding of routing, DNS, firewalls and VPNs, and how to debug them.
•Experience with physical servers, including diagnosing hardware failures.
•Understanding of the security implications of infrastructure changes, including patching vulnerabilities, enforcing access control and handling secrets.
•Strong troubleshooting skills, with a focus on identifying root cause rather than symptoms.
•Understanding of how systems depend on one another, and the ability to plan changes without disrupting production.
•Experience with scripting and configuration management tools such as Ansible.
•Experience using metrics, dashboards, alerts and logs to monitor and understand systems.
•Experience translating compliance requirements into practical infrastructure changes.
•Ability to work closely with developers and raise questions early.
Nice to have
•Experience running a fleet of servers (hundreds of hosts)
•Experience with ZFS
•Experience with WireGuard networks
•Experience with KVM/QEMU virtualization
•Experience with VictoriaMetrics, Grafana and ELK
•Ability to read Go code
•Experience with rootless containers such as Podman
•Experience with CoreDNS and Cloudflare
•Experience with Terraform and Kubernetes
•Experience implementing encryption at rest and encryption in transit
•Experience automating key rotation
•Experience automating certificate renewal and rotation as part of certificate lifecycle management (CLM), including issuance and revocation
•Experience with PKI (Public Key Infrastructure)
•Experience implementing security controls and applying security best practices to infrastructure
•Experience with enterprise certificate lifecycle management (CLM) platforms
•Experience with self-hosted key management tools, including key rotation
•Experience with secrets management tools, such as SOPS, OpenBao/Vault or AWS Secrets Manager
•Experience implementing encryption at rest on Linux hosts, including disk and filesystem encryption
•Experience automating certificate renewal for services running on Linux hosts
•Experience with security frameworks or audits, such as ISO 27001 or SOC 2
Conditions
No conditions stated in the posting.
