Lead Tech SRE

Kestra Technologies

6d•Remote

About The Position

Kestra is hiring a Lead Tech SRE to own Kestra Cloud end to end, including its architecture, specifications, delivery, monitoring, and continuous improvement. Kestra Cloud is a fully managed SaaS edition in Beta, serving early customers with production workloads and targeting General Availability in 2027. Each customer receives a dedicated Kestra instance on dedicated infrastructure, creating a fleet of isolated stacks that must be provisioned, upgraded, and observed consistently as the customer base grows. The role leads a team of three, including the lead, while remaining hands-on with Terraform, Kubernetes manifests, and incident work. The Lead Tech SRE sets technical direction, writes and reviews designs, divides and dispatches work, and collaborates with the CTO, platform engineering teams, and the security engineer. This is an engineering leadership role rather than a people-management-only position. The role owns the target architecture of Kestra Cloud on GCP and the path from Beta to GA. It covers customer-specific infrastructure, infrastructure templates and versioning, regions, service-level objectives and error budgets, automated customer-instance lifecycle management, release safety across the fleet, observability, on-call and incident response, capacity planning, and GCP cost efficiency. The Lead Tech SRE also works with security engineering on platform hardening and SOC 2 expectations, and feeds product changes back to Kestra core engineering when needed. During the first six months, the Lead Tech SRE will take over and audit the current architecture, map Beta-to-GA gaps, publish the GA architecture specification and SLOs with the CTO, turn them into a team roadmap, and deliver initial GA milestones: one-click customer-instance provisioning, observability coverage, and a safe upgrade path. After six months, the role will continue improving the platform, including re-architecting the first version based on lessons from Beta and early GA customers.

Requirements

At least 8 years of experience in SRE, platform, or infrastructure engineering.
At least 2 years leading the technical direction of a team or platform.
Deep, production-grade Kubernetes expertise, including operating fleets of clusters at scale and handling upgrades, configuration drift, networking, and resource sizing.
Strong Google Cloud experience with GKE, IAM, networking (VPC, private clusters, and load balancing), and managed data services; equivalent AWS or Azure experience is not a substitute.
Expert Terraform skills, including designing module structures and state layouts that scale across many similar customer environments.
Demonstrated ability to architect, write specifications, and dispatch work; able to present design documents, explain trade-offs, and describe how work was divided and delivered.
Real on-call and incident experience, including running postmortems and turning them into durable fixes.
Experience operating SaaS products for paying customers with meaningful SLOs.
Fluent in English and comfortable working autonomously in a fully remote environment.
Pragmatic approach, choosing straightforward solutions when appropriate and explaining the reasoning.

Nice To Haves

Experience running workloads that execute untrusted or user-defined code, such as sandboxing, gVisor, or node-pool isolation.
Experience building or operating a fleet control plane for per-customer environments, using Kubernetes operators, Crossplane, GKE Fleet / Config Sync, or custom provisioning services.
GCP FinOps experience, including per-customer cost attribution, committed use discounts, and spot node pools.
Exposure to SOC 2 or ISO 27001 audits from the infrastructure side.
Familiarity with workflow orchestration tools such as Kestra, Airflow, or Temporal, or with the JVM in production.

Responsibilities

Own the target architecture of Kestra Cloud on GCP, including each customer's dedicated stack, infrastructure templates and versions, regions, and the path from Beta to GA.
Write design documents, RFCs, and ADRs that translate product needs into infrastructure work, and explain and defend architecture trade-offs.
Define service- and tier-level SLOs and error budgets, and use them to guide prioritization.
Break specifications into work, dispatch it across the team, review designs and implementation, and unblock the two SREs.
Set standards for Terraform modules, Helm charts, and GitOps conventions.
Automate the customer-instance lifecycle, including provisioning, upgrades, scaling, backups, migration, and decommissioning, without manual steps.
Own the Kestra Cloud release path using ArgoCD and GitHub Actions, including progressive rollouts, rollback, and safe upgrades across customer instances.
Build observability across metrics, logs, traces, and alerting so issues are identified before customers report them.
Run team on-call and incident response, including rotation, runbooks, blameless postmortems, and delivery of follow-up fixes.
Plan capacity for bursty workloads and ensure autoscaling is effective.
Drive GCP cost efficiency through per-customer cost visibility, right-sizing, committed use, and appropriate use of spot capacity.
Harden the platform with the security engineer, including network policies, workload identity, secrets, and audit trails toward SOC 2 expectations.
Identify Kestra product issues that make cloud operations difficult, propose fixes, and work with core engineering to deliver them.
Audit the current Kestra Cloud architecture, define the gaps between Beta and GA, and deliver early GA milestones with the SRE team.
Lead ongoing platform improvement, including re-architecture informed by Beta and early GA customer experience.