Staff Site Reliability Engineer (SRE)

About Virtru:

While the rest of the security industry obsesses over locking data down to prevent it from being lost or stolen, we're doing something fundamentally different at Virtru. We're setting data free so that you can intentionally share it with others, but without sacrificing security, privacy, or control.

We've created both a suite of powerful data protection applications and an open platform that's sparking an ecosystem of innovation. Through the Trusted Data Format (TDF) open standard, we're not just protecting data; we're creating a new paradigm where security enables sharing rather than preventing it.

Think of us as the Android of data protection: a robust platform with an open core that developers and partners can build upon, coupled with our own best-in-class applications that showcase what's possible when you reimagine security from the ground up.

Backed by Iconiq Capital, Bessemer Venture Partners, Foundry Capital, and Tiger Global, we're helping Fortune 500 companies and government agencies discover that true data security means having the freedom to share, collaborate, and innovate — without compromise.

Compensation: $190,000 - 250,000/year

Team & Position Details:

Virtru protects data wherever it travels, for customers ranging from commercial enterprises to the Department of Defense, the Intelligence Community, Law Enforcement, and Federal Civilian agencies. Many of these customers are deploying one of Virtru’s product stack in their mission environments, and some of those environments have no path to the internet.

As a Staff Site Reliability Engineer (SRE) in the Delivery Engineering organization, you’d be helping to build a founder team focused on making these deployments simple, easy, and fast. You’ll be relentless in the pursuit of one-click deployability, automating the hard stuff to ensure that we make every deployment faster and more reliable than the last one. You’ll build and maintain a compatibility matrix customers can self service without engineering support, build automation to test and validate releases for deployability before they ship rather than after, and architect and deliver observability and diagnostics a customer can run and act on without us in the room. We build the automation, packaging, and tooling that makes that true, and we turn what we learn on each customer into something every later customer reuses.

You’ll work directly with deployment engineers and forward deployed engineers to identify needs and turn long run books and disparate bootstrap scripts into working software that solves their problems. You’ll also interact with our product engineering teams to influence their roadmap to deliver critical infrastructure and platform capabilities that improve deployment reliability and repeatability. You will work alongside a Principal Software Development Engineer who owns Delivery Engineering’s engineering standard and reusable-asset architecture. You own the delivery path built under it, and you will write the criteria a release has to meet before it can ship to a customer.

The impact of this role is company and product wide, heavily enabling our goals to scale Virtru, partner, and customer led deployments non-linearly without having to throw more humans at the problem. You’ll be expected to come up with AI-native design patterns that will increase our velocity without compromising our high bar for quality and security. The right candidate is excited about working on a small, nimble, highly autonomous and empowered team where everyone is expected to make high judgement, high velocity decisions independently and with urgency. If you want a role where the connection between what you build and what the company achieves requires no explaining, this is one.

As a Staff Site Reliability Engineer (SRE), your responsibilities will include:

Own deployment automation for the Data Security Platform : how it is packaged, installed, upgraded, and validated in environments Virtru does not operate. You will author the criteria a release has to meet before it is allowed to ship to a customer, and you will be the recognized authority on whether a given environment is ready for one.

Build the air-gapped delivery path end to end. Offline bundles, mirrored registries, signed artifacts with a software bill of materials, and an upgrade that completes with no egress, no shell access, and no telemetry coming back.

Partner with QA to build the reproducible test fleet and deployment test harness that proves a release works across the Kubernetes distributions, identity providers, and version states our customers actually run, and that produces our published compatibility matrix as a by-product rather than as a document somebody maintains by hand.

Additional responsibilities include:

Establish the infrastructure-as-code baseline for a standard deployment, so every deployment and upgrade starts from a known state.

Instrument deployments so we can measure time to value, upgrade lag, first-time-right rate, and cost per deployment, and hand that telemetry to our Operations partners to support continuous improvement.

Design for disconnected operation from the start. In classified and air-gapped environments automated telemetry may be difficult or prohibitive to collect, so every collector needs a mode where a human reviews a local file and releases it.

Convert what we learn on each engagement into a reusable accelerator instead of another runbook.

Partner with our Platform Engineering counterparts on the build and release pipeline. They own the pipeline and you will own the criteria it enforces on our behalf.

Carry field findings into product decisions with a documented outcome, so the same class of deployment failure does not arrive a second time.

Act as the technical authority on hard customer deployment escalations, and convert each one into an enduring asset such as automation, tooling, or a product ticket (i.e., not tribal knowledge).

Set the technical bar for the engineers who join after you, and help us define what good looks like for this discipline across our organization and company.

Mentor, coach, and develop more junior engineers while cultivating a DevOps first mentality across our organization and the company.

Skills that will help you thrive in this role:

Top 3 must haves

You have shipped software into environments you could not reach. Air-gapped, disconnected, or otherwise customer-controlled, with no egress and no shell access. You have personally built an offline install bundle and a working upgrade path.

Have worked with Kubernetes across distributions. EKS, OpenShift, RKE2, k3s, or their equivalents, with real Helm packaging depth and a clear understanding of how the same application fails differently on each.

You embrace Infrastructure as code and reproducible environments as a discipline. Terraform or OpenTofu, CloudFormation, Ansible, and the ability to stand up a fleet that reproduces a customer's specific combination of distribution, identity provider, and version state on demand.

Nice to haves

Argo CD or GitOps at scale.

Windows Server, PowerShell, and MSI or MSIX packaging with code signing. Many of our customers' end-user environments are Windows-heavy and some of our policy enforcement points are deployed on Windows client endpoints. Preferred, not required.

Go proficiency, which is what the Data Security Platform and OpenTDF are written in.

Operational depth in Keycloak, OIDC, and SAML, and particularly in identity providers that are not Keycloak.

Federal compliance and software supply-chain tooling: STIG and OpenSCAP, SBOM generation, artifact signing with Sigstore or an equivalent.

Hands-on experience with Zarf, Hauler, oc-mirror, or troubleshoot.sh. We may adopt mature tooling in this space rather than rebuild it, so direct experience here moves you to the front of the line.

Podman and systemd-based container deploy