Staff Site Reliability Engineer (SRE)

Virtru•Washington, DC

3d•$190,000 - $250,000

About The Position

Virtru is hiring a Staff Site Reliability Engineer in its Delivery Engineering organization to make deployments of the Data Security Platform simple, fast, and reliable, including in customer-controlled and air-gapped environments. The role owns the delivery path for packaging, installation, upgrades, and release validation, and defines the criteria a release must meet before it can ship to customers. It also serves as the technical authority on whether an environment is ready for deployment. The engineer will build end-to-end offline delivery capabilities, reproducible deployment testing, and a self-service compatibility matrix. They will turn deployment scripts and runbooks into reusable software and accelerators, collaborate with deployment, forward-deployed, QA, Platform Engineering, Operations, and product engineering teams, and carry field findings into documented product decisions. The role has company-wide impact, with an emphasis on scaling deployments without proportionally increasing staffing and applying AI-native design patterns while maintaining quality and security. This is a highly autonomous role on a small team. The successful candidate will make high-judgment decisions, handle difficult customer deployment escalations, set technical standards, and mentor other engineers. The position requires credibility with customers and partners, including government security teams, and comfort diagnosing issues in environments where telemetry, dashboards, and shell access may not be available.

Requirements

Personally shipped software into air-gapped, disconnected, or customer-controlled environments with no egress and no shell access, including building an offline installation bundle and a working upgrade path.
Experience with Kubernetes across distributions such as EKS, OpenShift, RKE2, or k3s, including substantial Helm packaging experience and understanding of distribution-specific failure modes.
Strong infrastructure-as-code and reproducible-environment practices, using tools such as Terraform or OpenTofu, CloudFormation, or Ansible, with the ability to reproduce customer combinations of distribution, identity provider, and version state.
Ability to diagnose issues in environments where shell access and live dashboards may not be available.
Ability to earn trust and credibility with customers, partners, and internal stakeholders, including in discussions about security and prioritization.
Action-oriented, urgent, collaborative, adaptable, and comfortable with asynchronous communication.
Willingness to automate recurring operational toil rather than relying on improved runbooks.

Nice To Haves

Experience with Argo CD or GitOps at scale.
Windows Server, PowerShell, and MSI or MSIX packaging with code signing.
Go proficiency.
Operational experience with Keycloak, OIDC, SAML, and identity providers other than Keycloak.
Federal compliance and software supply-chain tooling, including STIG, OpenSCAP, SBOM generation, and artifact signing with Sigstore or an equivalent.
Hands-on experience with Zarf, Hauler, oc-mirror, or troubleshoot.sh.
Podman and systemd-based container deployment experience.
Familiarity with Zero Trust security architecture, Policy Enforcement/Decision Points, cryptography, attribute-based access control (ABAC), and identity.
Existing TS/SCI U.S. security clearance or eligibility to be submitted for one.

Responsibilities

Own deployment automation for the Data Security Platform, including packaging, installation, upgrades, and validation in environments Virtru does not operate.
Define release criteria and determine whether customer environments are ready for deployment.
Build the end-to-end air-gapped delivery path, including offline bundles, mirrored registries, signed artifacts with a software bill of materials, and upgrades that work without egress, shell access, or returned telemetry.
Partner with QA to build a reproducible test fleet and deployment test harness across customer Kubernetes distributions, identity providers, and version states, producing a published compatibility matrix.
Establish the infrastructure-as-code baseline for standard deployments so deployments and upgrades begin from a known state.
Instrument deployments to measure time to value, upgrade lag, first-time-right rate, and cost per deployment, and provide telemetry to Operations partners for continuous improvement.
Design for disconnected operation, including a human-reviewable local-file mode for collectors where automated telemetry is difficult or prohibited.
Turn lessons from customer engagements into reusable accelerators rather than additional runbooks.
Partner with Platform Engineering on the build and release pipeline, defining the criteria it enforces on behalf of Delivery Engineering.
Carry field findings into product decisions and document outcomes to prevent recurring deployment failures.
Act as the technical authority on difficult customer deployment escalations and turn each into lasting automation, tooling, or a product ticket.
Set technical standards for future engineers and help define the discipline across the organization.
Mentor, coach, and develop junior engineers and cultivate a DevOps-first mentality across the organization.