Infrastrucuture Engineer, Traffic

Whatnot•San Francisco, CA

85d•$207,000 - $230,000•Hybrid

About The Position

We're looking for an Infrastructure Engineer to own the path between Whatnot's customers and our code. The Traffic team owns every hop along that path: the edge, DNS, private connectivity, the service mesh, TLS, and internal access. We make it fast, reliable, and secure by default, so product engineers ship globally without thinking about the network. You'll partner closely with Reliability and Platform Engineering to get observability right. Network problems are only debuggable if the data already exists when the incident starts, so you'll work with those teams to instrument every layer of a request, land those signals in the tooling engineers already use, and make "is it the network?" a question answered with evidence in minutes instead of debated for hours. You'll work with Security just as closely on how traffic enters, leaves, and moves inside our perimeter. This is a hands-on, software-first role rather than a network administration one. You'll write controllers, extensions, and automation, and the bar for success is that other engineers stop needing to think about the layer you own. Our surface area covers the full journey of a request, and you will work across most of it: Shape how traffic reaches us at the edge, from caching and security posture to the routing decisions that determine how fast Whatnot feels in each part of the world Build and scale the private connectivity that carries traffic between our services, accounts, and clusters, and keep it secure as the topology grows Push our service proxy and mesh layer further, tuning it for the traffic patterns we actually have and extending it when the off-the-shelf configuration stops being enough Keep name resolution, TLS, and internal access boring, and automated, to the engineers who depend on them Make the network legible. Every layer of a request should be instrumented well enough that "is it the network?" gets answered with evidence in minutes instead of debated for hours Design for the failure cases first. Network changes carry enormous blast radius, so you will build tooling that makes correct changes easy and dangerous ones hard, and rehearse failover before we need it

Requirements

Bachelor’s degree in Computer Science, a related field, or equivalent practical experience.
7+ years of professional software engineering experience preferably running the network behind high-traffic applications.
Have deep, hands-on experience (3+ years) with Istio and Envoy. You know the components and configuration surface intimately and have tuned them successfully for very different use cases
Have written custom Envoy extensions when configuration alone wasn't enough
Know Kubernetes networking deeply, from CNI behavior and pod and service networking to ingress and how traffic actually moves inside and between clusters
Have operated a CDN at scale, preferably Cloudflare
Have run globally distributed applications and understand what differs when your users and your infrastructure sit in different regions
Have owned latency-sensitive systems and can reason precisely about where milliseconds come from and go
Have strong networking fundamentals across DNS, TLS, TCP, and routing, plus genuine curiosity about the layers beneath the application
Know modern cloud provider networking deeply, AWS in particular. You have designed VPC topology at scale and understand the tradeoffs between Transit Gateway, PrivateLink, peering, and NAT well enough to pick the right one and defend it
Debug across boundaries. You are comfortable with packet captures, proxy logs, and traces, and you answer "is it the network?" with data

Responsibilities

Shape how traffic reaches us at the edge, from caching and security posture to the routing decisions that determine how fast Whatnot feels in each part of the world
Build and scale the private connectivity that carries traffic between our services, accounts, and clusters, and keep it secure as the topology grows
Push our service proxy and mesh layer further, tuning it for the traffic patterns we actually have and extending it when the off-the-shelf configuration stops being enough
Keep name resolution, TLS, and internal access boring, and automated, to the engineers who depend on them
Make the network legible. Every layer of a request should be instrumented well enough that "is it the network?" gets answered with evidence in minutes instead of debated for hours
Design for the failure cases first. Network changes carry enormous blast radius, so you will build tooling that makes correct changes easy and dangerous ones hard, and rehearse failover before we need it

Benefits

Generous Holiday and Time off Policy
Health Insurance options including Medical, Dental, Vision
Work From Home Support
Home office setup allowance
Monthly allowance for cell phone and internet
Care benefits
Monthly allowance for wellness
Annual allowance towards Childcare
Lifetime benefit for family planning, such as adoption or fertility expenses
Retirement; 401k offering for Traditional and Roth accounts in the US (employer match up to 4% of base salary) and Pension plans internationally
Monthly allowance to dogfood the app
16 weeks of paid parental leave + one month gradual return to work company leave allowances run concurrently with country leave requirements which take precedence.