Senior Kubernetes and Open Source Platform Engineer

Zappsec Inc.; United States; À distance; USD 150 000 - 210 000; Plein temps

Résumé du poste

Zappsec Technologies Inc. seeks a Senior Kubernetes and Open Source Platform Engineer to advise on self-managed Kubernetes clusters in private infrastructures.

You will handle escalations, review platform health, and guide upgrade planning, while teaching client teams and producing runbooks. You will work with Harbor, GitLab Runner, MetalLB, and OpenSearch, focusing on CIS hardening, RBAC, and incident analysis.

Qualifications

• Experience with self-managed Kubernetes on private infrastructure.
• Hands-on with cluster lifecycle, upgrades, and CIS hardening.
• Ability to diagnose problems from logs and metrics without console access.
• Strong written communication for client runbooks and decision records.
• Proven track record of upgrade planning across multiple versions.

Responsabilités

• Provide advisory and escalation support for Kubernetes platforms (RKE2, Harbor, OpenSearch).
• Diagnose issues from logs and metrics and explain fixes to client teams.
• Design and review cluster topology, RBAC, and network policies.
• Plan upgrade paths, test restores, and document remediation steps.
• Share knowledge through runbooks, sessions, and written records.

Outils

Kubernetes

Rancher

RKE2

Harbor

GitLab Runner

MetalLB

OpenSearch

OpenSearch Dashboards

Calico

Cilium

CoreDNS

Longhorn

Description du poste

Senior Kubernetes and Open Source Platform Engineer

Zappsec Technologies Inc.

About the role

Zappsec advises clients who run their own Kubernetes platforms. Their engineers operate the clusters. You tell them how to operate them well, and you take the problems they cannot solve. The platforms in scope are self managed rather than cloud managed. Expect Rancher RKE2 on bare metal or private infrastructure, with Harbor, GitLab Runner, MetalLB, and OpenSearch around it. The work splits three ways. You answer escalations, you review platform health and upgrade plans, and you teach the client team what you find. You will rarely hold production admin rights.

What you will do

Advisory and escalation support

• Take escalations on Kubernetes, RKE2, Harbor, GitLab Runner, MetalLB, and OpenSearch.
• Diagnose problems from logs, metrics, manifests, and screen shares rather than direct console access.
• Work alongside client engineers while they apply the fix, and explain why it works.
• Reproduce complex failures in a lab environment when the client environment cannot be disturbed.
• Decide when an issue belongs upstream, then prepare the bug report or vendor case with the evidence attached.
• Track recurring escalations and name the underlying platform weakness that produces them.

Kubernetes and RKE2 depth

• Diagnose control plane issues covering etcd health, API server latency, scheduler behaviour, and certificate expiry.
• Advise on cluster topology, node pool design, and failure domain placement.
• Review RBAC, admission control, Pod Security Admission, and network policy design.
• Troubleshoot CNI and CSI behaviour, including pod networking, MTU problems, and volume attachment failures.
• Guide etcd backup strategy and test restore procedures against a real recovery target.
• Advise on CIS hardening profiles and air gapped installation patterns where the client requires them.

Open source platform components

• Harbor. Review project structure, robot accounts, replication rules, scanning policy, garbage collection, and storage growth.
• GitLab Runner. Advise on the Kubernetes executor, concurrency limits, caching, resource requests, and build isolation choices.
• MetalLB. Review layer 2 and BGP mode selection, address pool design, and peering with upstream routers.
• OpenSearch. Advise on shard and index strategy, index lifecycle policy, snapshot repositories, node roles, and cluster sizing.
• Flag where a component has been pushed past its design intent, and say what should replace it.

Upgrade planning and platform health reviews

• Produce upgrade plans covering version skew, sequencing, prerequisites, and rollback.
• Detect deprecated and removed API usage before an upgrade rather than during it.
• Review Helm chart and CRD upgrade paths, including the ones that cannot be rolled back.
• Run periodic platform health reviews covering capacity, resource limits, backup validity, certificate lifetimes, and security posture.
• Write each review as a prioritized finding list with a remediation step per finding.
• Give the client an honest severity call, including the findings they will not want to hear.

Knowledge sharing

• Run periodic advisory sessions for the client platform team on a set cadence.
• Teach from real incidents in the client environment rather than generic material.
• Leave written runbooks and decision records behind, not slide decks alone.
• Build the client team’s capability so escalation volume falls over the engagement.

Requirements

• Six or more years in platform or infrastructure engineering, with three or more running Kubernetes in production.
• Direct operational experience with self managed Kubernetes on bare metal or private infrastructure.
• Hands‑on experience with Rancher or RKE2, including cluster lifecycle and upgrades.
• Working experience with at least three of Harbor, GitLab Runner, MetalLB, OpenSearch, and equivalent open source platform components.
• Proven record of Kubernetes upgrade planning and execution across multiple versions.
• Strong Linux, networking, and storage fundamentals. You can read a packet capture and an etcd metric.
• Ability to diagnose a problem you cannot touch, using evidence the client provides.
• Written communication strong enough that findings reach a client without an editor.

Preferred

• CKA, CKS, or CKAD certification.
• Experience in air gapped or regulated environments.
• Consulting, professional services, or vendor escalation background.
• GitOps experience with Argo CD or Flux.
• Observability depth across Prometheus, Grafana, and log pipeline design.
• Terraform, Ansible, or Helm authoring experience.
• Upstream contribution to any project in the scope above.

Tools you will use

• Orchestration: Kubernetes, Rancher, RKE2, containerd
• Registry: Harbor, Trivy
• CI: GitLab, GitLab Runner
• Networking: MetalLB, Calico or Cilium, CoreDNS, ingress controllers
• Search and logging: OpenSearch, OpenSearch Dashboards
• Storage: CSI drivers, Longhorn or equivalent block and object storage
• Observability: Prometheus, Grafana, Alertmanager
• Automation: Helm, Terraform, Ansible, Git
• Delivery: [Confirm ticketing and documentation stack]