Senior DevSecOps & Network Infrastructure Engineer

Description

About KWI

KWI builds the unified commerce platform that powers some of the world’s most recognized specialty and luxury retail brands. Behind every transaction, every clienteling interaction, and every store opening is an infrastructure team that keeps the lights on and is continuously raising the bar on how modern, and how secure, that platform runs. This is a role on that team.

The opportunity

If innovation lives in your DNA and AI is already part of how you think, build, and operate, you’re going to love what we’re doing at KWI. You’ll join a small, senior team with a real mandate to design, build, secure, and run the systems that power retail at scale. This is hands-on, on-prem infrastructure work: our own hypervisors, our own network edge, our own containers, and our own pipelines. We move fast, we automate aggressively, and we expect security to be built into the platform rather than bolted onto it. Your fingerprints will be on the platform every day.

The impact you’ll make

• Design, harden, and operate our on-prem footprint: VMware vSphere clusters, Linux virtual machines, and Docker workloads running across multiple datacenters and serving retail clients 24x7.
• Own the network edge. FortiGate policy design, NAT and VIPs, IPsec site-to-site and remote-access VPN, segmentation, IPS and UTM profiles, and disciplined change control on every rule you touch.
• Build security into the delivery pipeline. Container image and dependency scanning, SAST, secrets detection, IaC policy checks, signed artifacts, and vulnerability findings you drive to closure instead of to a spreadsheet.
• Containerize and template services with Docker and infrastructure-as-code so deployments are repeatable, declarative, and boring.
• Run the secrets and PKI plane: centralized secrets management, an internal certificate authority, automated certificate issuance and rotation, and a standing campaign to get hardcoded credentials out of the environment.
• Own incidents end to end: triage alerts, drive root-cause analysis across the application, network, database, and hypervisor layers, and write the post-incident docs that stop recurrence.
• Improve observability across the fleet. Metrics, logs, traces, dashboards, and firewall and flow telemetry, so problems are seen before customers feel them.
• Support audit, compliance, and penetration-test work: evidence collection, remediation SLAs, access reviews, and hardening baselines that hold up under scrutiny.
• Use modern AI-augmented engineering tools (Claude Code, MCP-based workflows, agentic automation) as a daily multiplier, to operate faster and extend what one engineer can deliver.
• Document and mentor. Runbooks, network diagrams, and design docs aren’t an afterthought here. They’re how the team scales.

What you will bring

Required

• 5+ years operating production Linux/UNIX (RHEL, CentOS/Rocky, Debian/Ubuntu) in an on-prem or hybrid environment at meaningful scale.
• Hands-on enterprise firewall experience, ideally FortiGate/FortiOS: policy design, NAT and VIPs, IPsec and SSL VPN, routing, HA pairs, and the judgment to change a live rule set safely. Deep Palo Alto or Cisco ASA/Firepower experience plus a genuine willingness to go deep on Fortinet also works.
• Strong networking fundamentals: TCP/IP, VLANs and segmentation, routing, DNS, TLS, HTTP/S, and load balancing. You can read a packet capture and a certificate chain and say what is actually happening.
• Production VMware vSphere experience: clusters and hosts, datastores, resource contention, snapshots and templates, and patching without an outage.
• Docker in production: image builds and hardening, registries, compose-based or orchestrated deployment, container networking, and troubleshooting the container that will not stay up.
• Practical DevSecOps: CI/CD pipelines with security gates, vulnerability management and CVE remediation at fleet scale, secrets management, and image scanning.
• Solid DevOps fundamentals: Git, CI/CD pipelines, Ansible (or similar configuration management), Terraform/OpenTofu (or similar IaC), and Docker.
• Comfortable scripting in Bash. Python is not required, but you should have a working understanding of programming fundamentals and be able to read, modify, and write straightforward code.
• Strong troubleshooting instincts and the temperament to lead under pressure.

Key skills (we’ll weigh heavily)

• Real day-to-day experience us…