Want to know if this job is worth applying to?
Europe
Remote only
Kestra is the universal orchestration platform: open source, declarative, and designed to orchestrate data pipelines, IT automation, business workflows, and AI/agentic systems.
Trusted by over 10,000 organizations worldwide, including JPMorgan Chase, Bloomberg, FILA, and Crédit Agricole, Kestra orchestrates mission-critical workloads at scale. The open-source project has close to 30,000 GitHub stars, hundreds of contributors, and a fast-growing global community.
Kestra Cloud is our fully managed SaaS edition of Kestra. Each customer gets a dedicated Kestra instance on dedicated infrastructure, so the platform is a fleet of isolated stacks rather than one shared cluster. It is in Beta today, running production workloads for early customers, with General Availability planned for 2027. Each instance runs arbitrary user code (scripts, containers, queries against their own systems) through hundreds of plugins, and the fleet grows with every new customer. Provisioning, upgrading, and observing dozens to hundreds of identical stacks without drift is the core problem.
We're looking for a Lead Tech SRE to own Kestra Cloud end to end: the architecture and specs, the delivery, the monitoring, and the continuous improvement of the platform. You decide how the platform should evolve, write it down, split it into work, and ship it with your team.
You would lead a team of three, yourself included. That means you stay hands-on (a large share of your week is Terraform, Kubernetes manifests, and incident work) while setting the technical direction, reviewing designs, and dispatching work to two SREs.
You work closely with the CTO, the platform engineering teams building the Kestra core, and our security engineer. This is an engineering leadership role, not a people-management-only one.
Architecture & specs
Own the target architecture of Kestra Cloud on GCP: the per-customer dedicated stack (cluster, network, databases, queues), how it is templated and versioned, regions, and the path from Beta to GA.
Write the specs (design docs, RFCs, ADRs) that turn product needs into infrastructure work, and defend the trade-offs: cost per customer vs isolation level, GCP project vs cluster vs node pool per customer, managed service vs self-run.
Define SLOs and error budgets per service and per tier, and make them the basis for prioritization.
Delivery
Break specs into work and dispatch it across the team, then review and unblock. You set the bar for Terraform modules, Helm charts, and GitOps conventions.
Automate the customer instance lifecycle: provisioning, upgrades, scaling, backups, migration, and decommissioning, with no manual steps.
Own the release path of Kestra Cloud with ArgoCD and GitHub Actions: progressive rollouts, rollback, and upgrade safety across the whole fleet of customer instances.
Monitoring & operations
Build the observability stack (metrics, logs, traces, alerting) so that issues are caught before customers report them.
Run on-call and incident response for the team: rotation, runbooks, blameless postmortems, and follow-ups that actually ship.
Plan capacity for a workload that is bursty by nature, and keep autoscaling honest.
Continuous improvement
Drive cost efficiency (FinOps) on GCP: per-customer cost visibility, right-sizing, committed use, and spot where it fits.
Harden the platform with our security engineer: network policies, workload identity, secrets, and audit trails toward SOC 2 expectations.
Feed back into the product: when Kestra itself makes the cloud hard to run, you write the issue, propose the fix, and work with core engineering to land it.
Cloud: GCP (GKE, Cloud SQL, GCS, Cloud Load Balancing, IAM / Workload Identity)
Infrastructure as Code: Terraform, Helm
Orchestration: Kubernetes, Docker
Deployment & Repository: GitHub Actions, ArgoCD
Monitoring & Logs: OpenTelemetry, Elastic, Prometheus, Grafana
Datastore: PostgreSQL, Elasticsearch
Queuing: Redis, Kafka, AMQP
Programming language: Java, TypeScript (you read it; you don't need to write it daily)
8+ years in SRE, platform, or infrastructure engineering, including at least 2 years leading the technical direction of a team or a platform.
Deep, production-grade Kubernetes expertise: you have operated fleets of clusters at scale and know where they break (upgrades, configuration drift, networking, resource sizing).
Strong Google Cloud experience: GKE, IAM, networking (VPC, private clusters, load balancing), and managed data services. Equivalent depth on AWS or Azure is not a substitute here.
Expert Terraform: you have designed module structures and state layouts that scale to many identical customer environments, not just written resources.
Proven ability to architect, spec, and dispatch: you can show design docs you wrote, explain the trade-offs you made, and describe how you split the work and delivered it.
Real on-call and incident experience, including running postmortems and turning them into durable fixes.
SaaS operations background: you have run a product for paying customers, with SLOs that mattered.
Fluent in English and comfortable working autonomously in a fully remote environment.
Pragmatism: you pick the boring solution when it works and can explain why.
Experience running workloads that execute untrusted or user-defined code (sandboxing, gVisor, node pool isolation).
Built or operated a fleet control plane for per-customer environments (Kubernetes operators, Crossplane, GKE Fleet / Config Sync, or custom provisioning services).
FinOps practice on GCP: per-customer cost attribution, committed use discounts, spot node pools.
Exposure to SOC 2 or ISO 27001 audits from the infrastructure side.
Familiarity with workflow orchestration (Kestra, Airflow, Temporal, or similar) or the JVM in production.
Month 1: take over the current architecture, audit the current Kestra Cloud architecture, and map the gaps between Beta and GA.
Months 2 to 3: publish the GA architecture spec and the SLOs, agree on them with the CTO, and turn them into a roadmap the team can execute.
Months 4 to 6: deliver the first GA milestones (one-click provisioning of a customer instance, observability coverage, safe upgrade path) with your two SREs.
After month 6: drive continuous improvement of the platform, including a re-architecture of the first version of Kestra Cloud based on what Beta and the first GA customers taught us.
Work from anywhere: We're a remote-first company, so you can work from wherever feels like home. Plus, you'll have access to coworking spaces worldwide if you ever need a change of scenery.
Health coverage: From medical support, dental, and vision, we've got you covered.
Home office setup on us: We'll provide all the equipment you need to work comfortably.
We aim to move quickly (2-3 weeks), but we can adjust the timeline if needed.
Intro call with our CEO (30 min)
Technical scenario / Practical assessment (2 hours, asynchronous: write a short design spec for a Kestra Cloud scenario on GKE and Terraform, including how you would split the work across a team of three)
Architecture review with our CTO, walking through your spec and the trade-offs (45 min)
.jpg?1627056988){kind=logo}