Network Engineer

blacklight.network; Columbus (OH); On-site; USD 130,000 - 170,000; Full time

Benefits offered by this job

Potential equity

401(k)

Insurance: medical, dental, vision, or

Job summary

blacklight.network is building a next-generation secure networking stack from the ground up, and you will work directly with the CTO on a new design rather than an inherited one, ensuring your judgment shapes the architecture.

You will own secure overlay networking, private service discovery across WireGuard, IPv6, DNS, routing, and nftables, plus edge policy, authentication, and visibility. The role offers equity potential and a competitive benefits package.

Qualifications

• Hands-on production experience with IPv6, routing, DNS, service discovery, and firewall policy.
• WireGuard in production; signals like Tailscale/headscale are a strong signal.
• Production Linux and container infrastructure experience.
• Working knowledge of mTLS, certificate enrollment, rotation, revocation, keys, and access control.

Responsibilities

• Secure overlay networking and private service discovery across WireGuard, IPv6, DNS, routing, and nftables.
• Enforce least-privilege ingress and egress at the edge.
• Create attributable protected paths with authorization, expiration, revocation, and evidence.
• Provide network visibility, incident diagnosis, and durable runbooks.

Skills

WireGuard

IPv6

DNS

Routing

Firewall policy

Tools

Linux

Containers

Tailscale/Headscale

Job description

Secure overlay networking, private service discovery, and attributable network paths.

Why this role

You will work directly with the CTO on a network design being made now rather than inherited, which means your judgment shows up in the architecture.

What you will own

• Secure overlay networking and private service discovery across WireGuard, IPv6, DNS, routing, and nftables.
• Least-privilege ingress and egress policy enforced at the edge.
• Attributable protected paths with explicit authorization, expiration, revocation, and evidence.
• Transparent egress controls, network visibility, incident diagnosis, and durable runbooks.

What we need

• Hands-on production experience with IPv6, routing, DNS, service discovery, and firewall policy.
• WireGuard in production; Tailscale, Headscale, or a comparable secure overlay is a strong signal.
• Production Linux and container infrastructure experience.
• Working knowledge of mTLS, certificate enrollment, rotation, revocation, keys, and access control.

Compensation

$130K–$170K.

Benefits

• Potential equity
• 401(k)
• 100% paid family medical, dental, vision, and life insurance.