Site Reliability Engineer

Our Culture

How we work:

• We move Blitzy Fast: Time is both our company’s and our clients’ most precious asset. We move quickly and decisively to innovate internally and deliver exceptional software externally.

About the Role

In this role, you will own the reliability, security posture, and operational readiness of Blitzy’s compute-intensive AI workloads across both our multi-tenant/single-tenant PaaS offerings and air-gapped or public sector customer-hosted cloud environments. You will lead our infrastructure alignment with FedRAMP High (Class D) baselines, ensuring seamless FedRAMP certification and customer Authorization to Operate (ATO) processes while maintaining peak performance for autonomous code generation and validation pipelines.

Responsibilities

• FedRAMP & Government Compliance Engineering. Architect and maintain cloud infrastructure aligned with FedRAMP High(Class D), NIST SP 800-53, and DoD Impact Level (IL4/IL5) security controls across AWS GovCloud or higher impact levels over AWS classified regions.

• Customer-Hosted & PaaS Deployment Management. Deploy, operate, and automate Blitzy’s Kubernetes-based platform across both Blitzy-managed PaaS environments and customer-controlled, isolated VPCs.

• Continuous Monitoring & Vulnerability Remediation. Implement automated compliance-as-code, continuous monitoring (ConMon), and vulnerability scanning pipelines to meet strict federal SLA timelines for POA&M and CVE remediation.

• Air-Gapped & Boundary-Contained Observability. Design and operate logging, metrics, tracing, and alerting stacks that function completely within strict customer security boundaries without external data egress.

• AI Workload Orchestration & Capacity Planning. Optimize Kubernetes clusters, GPU/compute scheduling, and distributed storage to support long-running, parallel AI agent execution and codebase knowledge graph ingestion.]

• Zero-Trust Identity & Secrets Management. Enforce least-privilege access controls, FIPS 140-3 validated encryption in transit and at rest, mutual TLS (mTLS), and automated secrets rotation.

• Support Blitzy’s Security and Compliance team’s efforts to produce evidence and documentation for third-party assessment organizations (3PAOs), System Security Plans (SSPs), and architecture diagrams.

• Participate in cleared on-call rotations, lead root-cause analyses for production or customer-hosted escalations, and drive automated "fix-forward" reliability improvements.

• Lead efforts to architect and deploy resilient infrastructure on AWS GovCloud / Azure Government. Support FedRAMP requirements for at least annual automated fail-over and recovery.

• Support FedRAMP vulnerability management handling rules (NTC-0014), POAM, and Incident Response (if any) monthly reporting.

• Define and maintain SLOs, SLIs, and error budgets for customer-hosted deployments, agreeing shared reliability targets with customers where Blitzy does not run the environment.

• Run change control for customer-hosted releases. Deliver signed, versioned Helm and image releases with tested upgrade and rollback paths, schedule rollouts around customer change windows and change management reviews, and keep the configuration baselines and release notes current for audit evidence.

Qualifications

• 5+ years of experience in Site Reliability Engineering, DevSecOps, or Platform Engineering managing production workloads on AWS (including GovCloud) or Azure Government.

• Hands-on experience building, hardening, and auditing systems for FedRAMP, NIST 800-53, FISMA, or DISA STIG compliance, including active participation in achieving or maintaining a FedRAMP certification / customer ATO.

• Deep, hands-on Linux knowledge (RHEL, Bottlerocket, Debian, Ubuntu, or similar): kernel, systemd, networking and troubleshooting.

• Deep expertise managing production Kubernetes clusters (EKS, AKS, or OpenShift), Helm charts, service meshes, and containerized workloads at scale.

• Strong proficiency with Terraform, Ansible, or similar IaC tools to provision repeatable, immutable environments across both PaaS and customer-hosted footprints.

• Experience implementing FIPS-compliant cryptography, hardened base images (e.g., CIS Benchmarks, Iron Bank), SBOM generation, and CI/CD security gates.

• Connect the platform to each customer’s idP (Okta, EntraID) over SAML/OIDC, with PIV/CAC sign-in, SCIM provisioning and role mapping. Document the identity data flows for ATO packages.

• Proven track record building end-to-end monitoring and SIEM integrations using tools such as Prometheus, Grafana, OpenTelemetry, Splunk, or Datadog within restricted network enclaves.

• Fluency in Python, Go, or Bash to build custom operational tooling, deployment automation, and self-healing infrastructure workflows.

• Proven experience defining SLOs, error budgets, and capacity modeling for production systems.

Compensation: $132,000-$198,000 + Bonus + Equity