Own our Envoy based edge, along with WAF rules, rate limiting and bot management across our cloud and CDN layers

Design and tune protections against abuse, including content scraping, credential attacks and traffic anomalies

Build detection for the traffic patterns that matter, and keep improving its signal to noise ratio

Harden our AWS estate: IAM boundaries, least privilege access, threat detection and runtime monitoring on EKS

Manage secrets, certificates and token lifecycle across the platform

Produce the infrastructure evidence behind ISO 27001 audits, penetration tests and enterprise security reviews

Run PostgreSQL and RDS in production across regions, covering upgrades, performance, encryption and access control

Own our search infrastructure, Typesense and vector search, end to end

Work with MongoDB and Elasticache alongside the primary data stores

Own the monitoring platform: Grafana, Loki and Prometheus, plus Sentry and PagerDuty

Build alerting people actually trust, with meaningful thresholds, low noise and clear runbooks

Improve how logs and metrics flow from the edge and the application into the stack

5+ years in infrastructure, SRE or security engineering, with strong AWS depth

Real experience with edge, WAF or reverse proxy technology: Envoy, nginx, Cloudflare, ModSecurity, Coraza or equivalent

Production Kubernetes, ideally EKS, and strong Terraform

Operating PostgreSQL at scale. You have done upgrades and performance work, not just connected to one

Practical observability experience. You have built alerting that worked, and killed alerting that did not

A security engineer's instincts. You think about what an attacker does with the thing you just shipped

English at a working professional level. Our engineering team is international

Search infrastructure: Typesense, Elasticsearch, OpenSearch or vector search

Content protection and anti-scraping work

Having supported ISO 27001, SOC 2 or similar audits from the technical side

Healthcare, fintech or another regulated domain

Polish. Much of the engineering team is in Poland, though the company works in English

On-call. We run a 24/7 rotation through PagerDuty, with documented playbooks and readiness checklists. Participation is agreed with you rather than assumed, and separately compensated.

Cadence. Written async updates, a fortnightly planning touchpoint and a regular infrastructure and security sync. You set your own hours and choose your own tools.

Documentation. Threat models, decision records and runbooks are part of the work. We expect the reasoning to be written down, not just the config.

Autonomy. Small team, wide scope, very little process between you and a decision.

Own our Envoy based edge, along with WAF rules, rate limiting and bot management across our cloud and CDN layers

Design and tune protections against abuse, including content scraping, credential attacks and traffic anomalies

Build detection for the traffic patterns that matter, and keep improving its signal to noise ratio

Harden our AWS estate: IAM boundaries, least privilege access, threat detection and runtime monitoring on EKS

Manage secrets, certificates and token lifecycle across the platform

Produce the infrastructure evidence behind ISO 27001 audits, penetration tests and enterprise security reviews

Run PostgreSQL and RDS in production across regions, covering upgrades, performance, encryption and access control

Own our search infrastructure, Typesense and vector search, end to end

Work with MongoDB and Elasticache alongside the primary data stores

Own the monitoring platform: Grafana, Loki and Prometheus, plus Sentry and PagerDuty

Build alerting people actually trust, with meaningful thresholds, low noise and clear runbooks

Improve how logs and metrics flow from the edge and the application into the stack

5+ years in infrastructure, SRE or security engineering, with strong AWS depth

Real experience with edge, WAF or reverse proxy technology: Envoy, nginx, Cloudflare, ModSecurity, Coraza or equivalent

Production Kubernetes, ideally EKS, and strong Terraform

Operating PostgreSQL at scale. You have done upgrades and performance work, not just connected to one

Practical observability experience. You have built alerting that worked, and killed alerting that did not

A security engineer's instincts. You think about what an attacker does with the thing you just shipped

English at a working professional level. Our engineering team is international

Search infrastructure: Typesense, Elasticsearch, OpenSearch or vector search

Content protection and anti-scraping work

Having supported ISO 27001, SOC 2 or similar audits from the technical side

Healthcare, fintech or another regulated domain

Polish. Much of the engineering team is in Poland, though the company works in English

On-call. We run a 24/7 rotation through PagerDuty, with documented playbooks and readiness checklists. Participation is agreed with you rather than assumed, and separately compensated.

Cadence. Written async updates, a fortnightly planning touchpoint and a regular infrastructure and security sync. You set your own hours and choose your own tools.

Documentation. Threat models, decision records and runbooks are part of the work. We expect the reasoning to be written down, not just the config.

Autonomy. Small team, wide scope, very little process between you and a decision.