Linux Isolation & Networking Systems Engineer

Kaseya Careers; Toronto; On-site; CAD 160,000 - 240,000; Full time

Job summary

Kaseya in Toronto, ON, is seeking a Systems Engineer to design and implement the Linux isolation, sandboxing, and network interception infrastructure that powers the Kaseya Intelligence Platform. This role focuses on low‑level engineering at the Linux and network boundary rather than application code.

You will work with Go, Rust, or C/C++, apply security controls, and collaborate with Platform, Security, and Backend teams to deliver scalable, secure workloads in multi‑tenant environments.

Qualifications

• Experience developing production systems software using Go, Rust, C, or C++.
• Experience working with Linux internals, including namespaces, cgroups, netfilter or iptables, sockets, and process lifecycle management.
• Experience implementing or operating at least one sandboxing or workload-isolation technology, such as gVisor, Firecracker, WebAssembly, containers, or micro virtual machines.
• Experience building networking infrastructure involving TCP/IP, transparent proxying, or TLS termination and origination.
• Experience implementing process isolation, privilege separation, protected credential handling, or related operating-system security controls.

Responsibilities

• Build and operate a transparent sidecar proxy that intercepts outbound vendor API calls, enforces credential and compliance policies, and records tamper-evident audit events
• Implement process-isolation controls using Linux users and permissions, namespaces, cgroups, ptrace restrictions, protected memory, and explicit credential cleanup
• Evaluate and implement sandboxing approaches using technologies such as gVisor, Firecracker, WebAssembly runtimes, or Unix-domain-socket isolation
• Design infrastructure that enforces workload and customer boundaries across large numbers of isolated execution environments
• Evaluate and integrate workload identity and attestation technologies such as SPIFFE and SPIRE
• Implement secure workload startup sequencing, including KMS access, token preparation, network-rule installation, and readiness signalling
• Improve the performance, observability, reliability, and failure recovery of the execution and isolation layers
• Partner with Platform, Security, and Backend Engineering teams to define interfaces, investigate production issues, and deploy platform improvements

Skills

Go/Rust/C/C++ development

Linux internals

Sandboxing/workload isolation

Networking infrastructure

OS security controls

Tools

gVisor

Firecracker

WebAssembly

Job description

Kaseya in Toronto, ON, is seeking a Systems Engineer to design and implement the Linux isolation, sandboxing, and network interception infrastructure that powers the Kaseya Intelligence Platform. This role focuses on low‑level engineering at the Linux and network boundary rather than application code.

You will work with Go, Rust, or C/C++, apply security controls, and collaborate with Platform, Security, and Backend teams to deliver scalable, secure workloads in multi‑tenant environments.