2 months ago
Pune, IndiaStaff+
Responsibilities
- Design and build process isolation, sandboxing, and network interception infrastructure for secure sidecar architecture.
- Build and maintain the Fleet transparent authenticating proxy, including TCP interception, credential management, compliance enforcement, and tamper-evident audit logging.
- Harden isolation between sidecars and automation workloads through UID separation, ptrace restrictions, protected credential memory, and secure plaintext zeroing.
- Evaluate and implement sandboxing approaches using gVisor, Firecracker micro VMs, WebAssembly runtimes, and Unix domain sockets.
- Maintain structural namespace isolation across thousands of Temporal namespaces.
- Evaluate SPIFFE/SPIRE for workload identity attestation within sandboxed execution environments.
- Implement sidecar startup sequencing for KMS credential retrieval, OAuth token warming, iptables rules, and readiness signaling.
Requirements
- Deep Linux systems experience with iptables/netfilter, process namespaces, cgroups, socket options, and Unix domain sockets.
- Experience with at least one sandboxing or isolation technology, such as gVisor, Firecracker micro VMs, WebAssembly runtimes, or an equivalent.
- Strong networking fundamentals, including TCP/IP, transparent proxying, TLS termination, and TLS origination.
- Experience designing language-agnostic platforms that support workloads across runtimes.
- Comfort working with memory management, process lifecycle, and privilege separation close to the operating system.
- Go or Rust experience is strongly preferred; C or C++ experience is relevant.
- Familiarity with SPIFFE/SPIRE or similar workload identity frameworks is preferred.
- Experience building or operating multi-tenant container or VM isolation infrastructure is preferred.
- Prior experience with security tooling, EDR, or zero-trust networking is preferred.
- Familiarity with infrastructure-level KMS integrations such as AWS KMS or Azure Key Vault is preferred.
About Kaseya
Kaseya builds IT management and cybersecurity software for managed service providers and internal IT teams, delivered as a unified, subscription-based platform covering RMM, PSA, backup, endpoint protection, and SOC services. Founded in 2000 and headquartered in Miami, it is privately held and backed by Insight Partners. The company expanded its portfolio with acquisitions including Datto, and is used by MSPs and SMBs to automate and secure infrastructure.