Systems Engineer — Linux Isolation & Networking

Jobgether; Toronto; On-site; CAD 160,000 - 240,000; Full time

Benefits offered by this job

Full-time employment

Advanced Linux & security tech

Job summary

Jobgether is seeking a Systems Engineer — Linux Isolation & Networking in Canada to design and operate secure, multi-tenant infrastructure at the OS and network level. You’ll implement namespaces, cgroups, and sandboxing to protect workloads and credentials while enabling scalable, compliant environments.

The role collaborates with Platform, Security, and Backend teams and involves low-level systems programming, networking, and cloud integration with technologies like gVisor, Firecracker, and

Qualifications

• Professional experience developing production-grade systems software using Go, Rust, C, or C++.
• Strong understanding of Linux internals, including namespaces, cgroups, netfilter or iptables, sockets, and process lifecycle management.
• Hands-on experience implementing or operating sandboxing or workload-isolation technologies such as gVisor, Firecracker, WebAssembly, containers, or micro virtual machines.
• Experience building networking infrastructure involving TCP/IP, transparent proxying, TLS termination, or TLS origination.
• Practical experience with process isolation, privilege separation, protected credential handling, or related operating-system security controls.
• Experience with multi-tenant container, sandbox, or virtual-machine isolation infrastructure is highly valued.
• Familiarity with workload identity and attestation frameworks such as SPIFFE or SPIRE is a plus.
• Experience with cloud key-management services such as AWS KMS, Azure Key Vault, or Google Cloud KMS is desirable.
• Background in endpoint security, EDR, zero-trust networking, infrastructure security, Kubernetes, container runtimes, or managed container platforms is advantageous.
• Experience with Temporal or another durable workflow execution platform is a plus.
• Strong analytical, troubleshooting, and collaboration skills, with the ability to work effectively across infrastructure, security, and backend teams.

Responsibilities

• Build and operate secure infrastructure for process isolation, sandboxing, workload execution, and network interception across multi-tenant environments.
• Develop transparent sidecar proxy capabilities that intercept outbound API traffic, enforce credential and compliance policies, and generate tamper-evident audit records.
• Implement Linux-based process isolation using users and permissions, namespaces, cgroups, ptrace restrictions, protected memory, and secure credential-handling practices.
• Evaluate and integrate sandboxing technologies such as gVisor, Firecracker, WebAssembly runtimes, and Unix-domain-socket isolation.
• Design mechanisms that reliably enforce workload and customer boundaries across large numbers of isolated execution environments.
• Evaluate and implement workload identity and attestation technologies, including SPIFFE and SPIRE.
• Build secure workload startup and initialization flows covering KMS access, token preparation, network-rule configuration, and readiness signaling.
• Improve the performance, observability, reliability, and failure recovery of execution and isolation infrastructure.
• Partner with Platform, Security, and Backend Engineering teams to define technical interfaces, troubleshoot production issues, and deploy infrastructure improvements.

Skills

Go

Rust

C

C++

Tools

gVisor

Firecracker

WebAssembly

Containers

MicroVMs

Job description

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Systems Engineer — Linux Isolation & Networking based in Canada.

This is a high-impact systems engineering role focused on building secure infrastructure at the Linux, networking, and process boundaries. You’ll design and operate isolation and sandboxing technologies that enable secure workload execution in multi-tenant environments. The role combines low-level systems programming, networking, workload security, and cloud infrastructure. You’ll work on technologies such as Linux namespaces, cgroups, transparent proxies, workload identity, and sandboxing runtimes. Your work will help protect credentials, enforce customer and workload boundaries, and strengthen platform security. You’ll collaborate closely with Platform, Security, and Backend Engineering teams in a fast-moving, technology-driven environment.

Accountabilities:

• Build and operate secure infrastructure for process isolation, sandboxing, workload execution, and network interception across multi-tenant environments.
• Develop transparent sidecar proxy capabilities that intercept outbound API traffic, enforce credential and compliance policies, and generate tamper-evident audit records.
• Implement Linux-based process isolation using users and permissions, namespaces, cgroups, ptrace restrictions, protected memory, and secure credential-handling practices.
• Evaluate and integrate sandboxing technologies such as gVisor, Firecracker, WebAssembly runtimes, and Unix-domain-socket isolation.
• Design mechanisms that reliably enforce workload and customer boundaries across large numbers of isolated execution environments.
• Evaluate and implement workload identity and attestation technologies, including SPIFFE and SPIRE.
• Build secure workload startup and initialization flows covering KMS access, token preparation, network-rule configuration, and readiness signaling.
• Improve the performance, observability, reliability, and failure recovery of execution and isolation infrastructure.
• Partner with Platform, Security, and Backend Engineering teams to define technical interfaces, troubleshoot production issues, and deploy infrastructure improvements.

Requirements:

• Professional experience developing production-grade systems software using Go, Rust, C, or C++.
• Strong understanding of Linux internals, including namespaces, cgroups, netfilter or iptables, sockets, and process lifecycle management.
• Hands-on experience implementing or operating sandboxing or workload-isolation technologies such as gVisor, Firecracker, WebAssembly, containers, or micro virtual machines.
• Experience building networking infrastructure involving TCP/IP, transparent proxying, TLS termination, or TLS origination.
• Practical experience with process isolation, privilege separation, protected credential handling, or related operating-system security controls.
• Experience with multi-tenant container, sandbox, or virtual-machine isolation infrastructure is highly valued.
• Familiarity with workload identity and attestation frameworks such as SPIFFE or SPIRE is a plus.
• Experience with cloud key-management services such as AWS KMS, Azure Key Vault, or Google Cloud KMS is desirable.
• Background in endpoint security, EDR, zero-trust networking, infrastructure security, Kubernetes, container runtimes, or managed container platforms is advantageous.
• Experience with Temporal or another durable workflow execution platform is a plus.
• Strong analytical, troubleshooting, and collaboration skills, with the ability to work effectively across infrastructure, security, and backend teams.

Benefits:

• Base salary range of CAD $160,000–$240,000 per year for the Toronto position.
• Full-time employment with opportunities to work on advanced Linux, networking, cloud, and security infrastructure.
• Additional benefits and rewards may be available depending on the role and individual impact.
• Potential eligibility for additional incentive compensation, depending on the applicable role and plan.
• Opportunity to work with cutting-edge technologies in a high-growth, high-performance environment.
• Collaboration with multidisciplinary Platform, Security, and Backend Engineering teams.
• Professional growth opportunities in systems engineering, cloud infrastructure, and cybersecurity.
• Inclusive workplace committed to equal employment opportunity and a diverse workforce.

We appreciate your interest and wish you the best!

Data Privacy Notice: By submitting your application, you acknowledge that Jobgether will process your personal data to evaluate your candidacy and share relevant information with the hiring employer. This processing is based on legitimate interest and pre-contractual measures under applicable data protection laws (including GDPR). You may exercise your rights (access, rectification, erasure, objection) at any time.

#LI-CL1