Site Reliability Engineer

Overview

BeyondTrust is building a new cross-product Site Reliability Engineering team to stand up and run the AWS GovCloud environments that bring additional BeyondTrust products into FedRAMP authorization. The team owns reliability, change control, and continuous-compliance machinery so product feature teams can focus on product delivery.

What you'll do

• Build and operate AWS GovCloud environments: multi-account structure, guardrails, logging and security tooling, and IaC-native provisioning (Terraform)
• Build and run release and update machinery for cloud fleets: mandatory security updates, staged and jittered rollout windows, coordinated installs, and verification that a patch actually landed everywhere it was scoped to
• Build the continuous-compliance evidence pipeline: collection, normalization, and reporting of FedRAMP 20x Key Security Indicators, where evidence is machine-readable, re-verified every few days, and reported monthly
• Instrument production: telemetry, SLOs, dashboards, and alerting that the team and product engineering actually own and act on
• Consolidate CI/CD: shared pipelines for build, signing, artifact management, quality gates, and security scanning instead of per-team reinvention
• Participate in on-call for the GovCloud estate, with the explicit expectation that recurring incident causes get engineered away

What you'll need

• Experience building and operating AWS GovCloud environments: multi-account structure, guardrails, logging and security tooling, IaC-native provisioning (Terraform)
• Experience building and running release and update machinery for cloud fleets: mandatory security updates, staged and jittered rollout windows, coordinated installs, and verification that a patch actually landed everywhere it was scoped to
• Experience building the continuous-compliance evidence pipeline: collection, normalization, and reporting of FedRAMP 20x Key Security Indicators, where evidence is machine-readable, re-verified every few days, and reported monthly
• Experience instrumenting production: telemetry, SLOs, dashboards, and alerting that the team and product engineering actually own and act on
• Experience consolidating CI/CD: shared pipelines for build, signing, artifact management, quality gates, and security scanning instead of per-team reinvention
• Experience participating in on-call for an estate, with the expectation that recurring incident causes get engineered away

Nice to have

• Built or operated inside a FedRAMP Moderate or High boundary (or IL4/IL5, StateRAMP equivalent): continuous monitoring, POA&M lifecycle, patch SLAs, 3PAO engagement
• AWS GovCloud specifically; multi-account landing zones; FIPS endpoints and crypto modes
• VM fleet or appliance-model operations at scale, not only Kubernetes
• Telemetry and data pipeline ownership (OTEL, Grafana-class stacks)
• Compliance-as-code and evidence automation (OSCAL, machine-readable ConMon, AWS Config rules or OPA at scale)
• Test and verification engineering: building the harnesses that prove a fleet is in the state the paperwork says it is

Details

• Location: US-based, remote
• Works inside a FedRAMP boundary; standard US-person requirements for federal environments apply
• Reports to the SRE Manager, within the VP of Application Engineering's organization
• Hands-on operational work is capped at roughly half of team capacity
• Participation in on-call for the GovCloud estate