Staff Site Reliability Engineer (SRE)

About Virtru: While the rest of the security industry obsesses over locking data down to prevent it from being lost or stolen, we're doing something fundamentally different at Virtru. We're setting data free so that you can intentionally share it with others, but without sacrificing security, privacy, or control. We've created both a suite of powerful data protection applications and an open platform that's sparking an ecosystem of innovation. Through the Trusted Data Format (TDF) open standard, we're not just protecting data; we're creating a new paradigm where security enables sharing rather than preventing it. Think of us as the Android of data protection: a robust platform with an open core that developers and partners can build upon, coupled with our own best-in-class applications that showcase what's possible when you reimagine security from the ground up. Backed by Iconiq Capital, Bessemer Venture Partners, Foundry Capital, and Tiger Global, we're helping Fortune 500 companies and government agencies discover that true data security means having the freedom to share, collaborate, and innovate — without compromise. Compensation: $190,000 - 250,000/year Team & Position Details: Virtru protects data wherever it travels, for customers ranging from commercial enterprises to the Department of Defense, the Intelligence Community, Law Enforcement, and Federal Civilian agencies. Many of these customers are deploying one of Virtru’s product stack in their mission environments, and some of those environments have no path to the internet. As a Staff Site Reliability Engineer (SRE) in the Delivery Engineering organization, you’d be helping to build a founder team focused on making these deployments simple, easy, and fast. You’ll be relentless in the pursuit of one-click deployability, automating the hard stuff to ensure that we make every deployment faster and more reliable than the last one. You’ll build and maintain a compatibility matrix customers can self service without engineering support, build automation to test and validate releases for deployability before they ship rather than after, and architect and deliver observability and diagnostics a customer can run and act on without us in the room. We build the automation, packaging, and tooling that makes that true, and we turn what we learn on each customer into something every later customer reuses. You’ll work directly with deployment engineers and forward deployed engineers to identify needs and turn long run books and disparate bootstrap scripts into working software that solves their problems. You’ll also interact with our product engineering teams to influence their roadmap to deliver critical infrastructure and platform capabilities that improve deployment reliability and repeatability. You will work alongside a Principal Software Development Engineer who owns Delivery Engineering’s engineering standard and reusable-asset architecture. You own the delivery path built under it, and you will write the criteria a release has to meet before it can ship to a customer. The impact of this role is company and product wide, heavily enabling our goals to scale Virtru, partner, and customer led deployments non-linearly without having to throw more humans at the problem. You’ll be expected to come up with AI-native design patterns that will increase our velocity without compromising our high bar for quality and security. The right candidate is excited about working on a small, nimble, highly autonomous and empowered team where everyone is expected to make high judgement, high velocity decisions independently and with urgency. If you want a role where the connection between what you build and what the company achieves requires no explaining, this is one. As a Staff Site Reliability Engineer (SRE), your responsibilities will include: • Own deployment automation for the Data Security Platform: how it is packaged, installed, upgraded, and validated in environments Virtru does not operate. You will author the criteria a release has to meet before it is allowed to ship to a customer, and you will be the recognized authority on whether a given environment is ready for one. • Build the air-gapped delivery path end to end. Offline bundles, mirrored registries, signed artifacts with a software bill of materials, and an upgrade that completes with no egress, no shell access, and no telemetry coming back. • Partner with QA to build the reproducible test fleet and deployment test harness that proves a release works across the Kubernetes distributions, identity providers, and version states our customers actually run, and that produces our published compatibility matrix as a by-product rather than as a document somebody maintains by hand. Additional responsibilities include: • Establish the infrastructure-as-code baseline for a standard deployment, so every deployment and upgrade starts from a known state. • Instrument deployments so we can measure time to value, upgrade lag, first-time-right rate, and cost per deployment, and hand that telemetry to our Operations partners to support continuous improvement. • Design for disconnected operation from the start. In classified and air-gapped environments automated telemetry may be difficult or prohibitive to collect, so every collector needs a mode where a human reviews a local file and releases it. • Convert what we learn on each engagement into a reusable accelerator instead of another runbook. • Partner with our Platform Engineering counterparts on the build and release pipeline. They own the pipeline and you will own the criteria it enforces on our behalf. • Carry field findings into product decisions with a documented outcome, so the same class of deployment failure does not arrive a second time. • Act as the technical authority on hard customer deployment escalations, and convert each one into an enduring asset such as automation, tooling, or a product ticket (i.e., not tribal knowledge). • Set the technical bar for the engineers who join after you, and help us define what good looks like for this discipline across our organization and company. • Mentor, coach, and develop more junior engineers while cultivating a DevOps first mentality across our organization and the company. Skills that will help you thrive in this role: • Top 3 must haves • You have shipped software into environments you could not reach. Air-gapped, disconnected, or otherwise customer-controlled, with no egress and no shell access. You have personally built an offline install bundle and a working upgrade path. • Have worked with Kubernetes across distributions. EKS, OpenShift, RKE2, k3s, or their equivalents, with real Helm packaging depth and a clear understanding of how the same application fails differently on each. • You embrace Infrastructure as code and reproducible environments as a discipline. Terraform or OpenTofu, CloudFormation, Ansible, and the ability to stand up a fleet that reproduces a customer's specific combination of distribution, identity provider, and version state on demand. • Nice to haves • Argo CD or GitOps at scale. • Windows Server, PowerShell, and MSI or MSIX packaging with code signing. Many of our customers' end-user environments are Windows-heavy and some of our policy enforcement points are deployed on Windows client endpoints. Preferred, not required. • Go proficiency, which is what the Data Security Platform and OpenTDF are written in. • Operational depth in Keycloak, OIDC, and SAML, and particularly in identity providers that are not Keycloak. • Federal compliance and software supply-chain tooling: STIG and OpenSCAP, SBOM generation, artifact signing with Sigstore or an equivalent. • Hands-on experience with Zarf, Hauler, oc-mirror, or troubleshoot.sh. We may adopt mature tooling in this space rather than rebuild it, so direct experience here moves you to the front of the line. • Podman and systemd-based container deployment, for the customers who will never run Kubernetes. • Familiarity with Zero Trust security architecture and concepts such as Policy Enforcement/Decision Points, cryptography, attribute-based access control (ABAC), and identity. • Existing TS/SCI US security clearance or eligible to be submitted for one. Not required for this role, but nice to have. • What are the dealbreakers? • A career spent entirely inside infrastructure you controlled. If every system you have shipped runs in your own cloud account, this role may not be for you. • Needing shell access and live dashboards to debug. In our hardest environments, a customer emails you a file and that coupled with a phone call may be the entire diagnostic surface. • Enduring operational toil without automation. If your answer to recurring toil is a better runbook rather than software to automate it, this isn’t a fit. • Inability to earn trust and credibility with partners and customers. You may be the person who has to explain to a skeptical government security team why our install is safe, or to an internal VP of Engineering why we need to prioritize critical platform features. Those have to be conversations you are willing and excited to have. Virtruvian qualities that will set you up for success: • Thinking outside of the box to respectfully challenge your teammates and managers in the pursuit of excellence • Strong sense of urgency with an action-oriented mindset • Able to collaborate and adapt to shifting priorities as business needs evolve • Comfortable with asynchronous communication including slack, email, zoom, etc. Perks & Benefits: At Virtru, we believe people do their best work when their wellbeing is put first. This is why we make your wellbeing our priority with a thoughtful and holistic program that encompasses Occupational, Mental, Social, Physical, and Environmental Wellness by offering benefits such as… • A Flexible PTO policy — we strongly encourage you to take time off (in addition to 14 holidays) to ensure that you are getting the proper time needed to unplug and recharge. • A $1,500 annual Learning & Development Stipend focused on providing you the resources to continually learn and professionally grow. • Frequent company-sponsored team celebrations that provide ample opportunities to connect with teammates and be social! • Access to an Employee Assistance Program • Access to Headspace, a mental health app tailored to your specific needs. • A flat 3% contribution to your retirement account • A high degree of flexibility — Have an appointment, errand, or family emergency to take care of? Hop to it! We give you the time and space to take care of you and your own first. In addition to wellbeing, Virtru places a strong emphasis on diversity, equity, inclusion, and belonging. Our DB&I Council is dedicated to fostering an inclusive workplace and making the psychological safety of each and every one of our teammates a top priority. Additional perks include: • Competitive compensation • Generous parental, medical, and bereavement policies • 401K contribution and stock options • Full medical, dental, and vision benefits • New Hire Swag and IT Welcome boxes • Structured semi-annual 360° performance reviews Virtru is committed to building an inclusive environment for people of all backgrounds and everyone is encouraged to apply. Virtru is an Equal Opportunity Employer and does not discriminate on the basis of race, color, gender, religion, disability, national origin, protected veteran status, age, or any other status protected by applicable national, federal, state, or local law.