Istio Mesh Engineer (Onsite) :: Dallas, TX (Relocation yes)

DMS Vision•Dallas, TX

7h•Onsite

About The Position

Design, deploy, and operate an Istio service mesh on AKS, including ingress and egress gateways, traffic shifting, retries and timeouts, and circuit breaking. Enforce zero-trust service-to-service security using mTLS and Istio authentication and authorization policies. Lead the transition from kubenet to Azure CNI, including Azure CNI Overlay, IP planning, subnetting, IPAM, and routing and NSG alignment. Implement Kubernetes network policies with Cilium or Calico to restrict east–west traffic and control egress. Establish compliant egress architectures and DNS patterns, and build GitOps workflows for mesh, Gateway API, and policy manifests. Define infrastructure as code for AKS and related Azure services, configure mesh PKI and certificates, and establish observability, security hardening, and disaster recovery practices. Partner with application teams on ingress migrations to Gateway API, canary and blue-green deployments, and documentation of implementation patterns. The position is onsite in Dallas, Texas, and relocation is available. The stated duration is six months.

Requirements

Strong Kubernetes/platform experience and production operations experience with Istio.
Knowledge of Azure networking, including VNets, UDR, NSG, NAT, and Private Link.
Experience with Kubernetes Network Policies and Cilium or Calico.
Experience with Argo CD or Flux, Helm or Kustomize, and Terraform or Bicep.
Experience with Azure DevOps or GitHub Actions pipelines.
Experience configuring PKI and certificates, Istio CA, cert-manager, Azure Key Vault, TLS termination, and certificate rotation.
Experience with observability tools including Prometheus/Grafana, OpenTelemetry/Jaeger, and Azure Monitor/Log Analytics.
Experience with CIS security hardening and OPA Gatekeeper or Kyverno policy enforcement.
Familiarity with YAML and bash, plus Go or Python.
Hands-on experience with Azure AD/Entra, Azure Workload Identity, Key Vault, and eBPF/Cilium.

Nice To Haves

Experience with Gateway API migrations.
Experience implementing canary or blue-green deployments using Argo Rollouts or Flagger.
Experience with Azure CNI Overlay and Azure networking.

Responsibilities

Design, deploy, and operate Istio service mesh on AKS, including ingress and egress gateways, traffic shifting, retries and timeouts, and circuit breaking.
Enforce zero-trust service-to-service security using mTLS, Authorization Policy, Peer Authentication, and Request Authentication.
Lead the kubenet-to-Azure-CNI transition, including Azure CNI Overlay, IP planning, subnetting, IPAM, and routing and NSG alignment.
Implement and validate Kubernetes Network Policies using Cilium or Calico to restrict east–west traffic and control egress.
Establish compliant egress architectures using NAT Gateway, Istio egress gateway, and Private Link, along with DNS patterns using CoreDNS and Private DNS Zones.
Build GitOps workflows with Argo CD or Flux for mesh, Gateway API, and policy manifests; manage their lifecycle with Helm or Kustomize.
Define infrastructure as code with Terraform or Bicep for AKS, networking, identity, and Key Vault, and integrate it with Azure DevOps or GitHub Actions pipelines.
Configure mesh PKI and certificates using Istio CA and cert-manager with Azure Key Vault, including TLS termination and automated rotation.
Stand up observability using Prometheus/Grafana, OpenTelemetry/Jaeger, and Azure Monitor/Log Analytics; publish SLOs, alerts, and runbooks.
Perform security hardening against CIS benchmarks, enforce policies with OPA Gatekeeper or Kyverno, and conduct disaster recovery drills.
Partner with application teams to refactor ingress to Gateway API/HTTPRoute, implement canary or blue-green deployments using Argo Rollouts or Flagger, and document patterns.