Kestra is the universal orchestration platform: open source, declarative, and designed to orchestrate data pipelines, IT automation, business workflows, and AI/agentic systems.
Trusted by over 10,000 organizations worldwide, including JPMorgan Chase, Bloomberg, FILA, and Crédit Agricole, Kestra orchestrates mission-critical workloads at scale. The open-source project has close to 30,000 GitHub stars, hundreds of contributors, and a fast-growing global community.
About the roleKestra Cloud is our fully managed SaaS edition of Kestra. Each customer gets a dedicated Kestra instance on dedicated infrastructure, so the platform is a fleet of isolated stacks rather than one shared cluster. It is in Beta today, running production workloads for early customers, with General Availability planned for 2027. Each instance runs arbitrary user code (scripts, containers, queries against their own systems) through hundreds of plugins, and the fleet grows with every new customer. Provisioning, upgrading, and observing dozens to hundreds of identical stacks without drift is the core problem.
We're looking for a Senior SRE to build and run Kestra Cloud: the infrastructure, the delivery pipeline, the monitoring, and the day-to-day reliability of the platform. You take ownership of large parts of the platform, from design to production, and ship them with the team.
You would join a team of three. You report to the Lead SRE and work alongside another SRE. Most of your week is hands-on (Terraform, Kubernetes manifests, CI/CD, and incident work), with real input on how the platform is designed.
You work closely with the Lead SRE, the platform engineering teams building the Kestra core, and our security engineer. This is a senior individual contributor role with real ownership, not a ticket-taking one.
What you would doArchitecture & specs
Contribute to the target architecture of Kestra Cloud on GCP: the per-customer dedicated stack (cluster, network, databases, queues), how it is templated and versioned, and the path from Beta to GA.
Write design docs (RFCs, ADRs) for the components you own, and argue the trade-offs: cost per customer vs isolation level, GCP project vs cluster vs node pool per customer, managed service vs self-run.
Implement SLOs and error budgets per service and per tier: the SLIs, the dashboards, and the burn-rate alerts behind them.
Delivery
Build Terraform modules and Helm charts that scale to a fleet of identical customer environments, and apply (and improve) the team's GitOps conventions. You review your peers' work and they review yours.
Automate the customer instance lifecycle: provisioning, upgrades, scaling, backups, migration, and decommissioning, with no manual steps.
Run the release path of Kestra Cloud with ArgoCD and GitHub Actions: progressive rollouts, rollback, and upgrade safety across the whole fleet of customer instances.
Monitoring & operations
Build and extend the observability stack (metrics, logs, traces, alerting) so that issues are caught before customers report them.
Take part in on-call and incident response: write runbooks, lead incidents when you are on call, run blameless postmortems, and ship the follow-ups.
Plan capacity for a workload that is bursty by nature, and keep autoscaling honest.
Continuous improvement
Improve cost efficiency (FinOps) on GCP: per-customer cost visibility, right-sizing, committed use, and spot where it fits.
Harden the platform with our security engineer: network policies, workload identity, secrets, and audit trails toward SOC 2 expectations.
Feed back into the product: when Kestra itself makes the cloud hard to run, you write the issue, propose the fix, and work with core engineering to land it.
Cloud: GCP (GKE, Cloud SQL, GCS, Cloud Load Balancing, IAM / Workload Identity)
Infrastructure as Code: Terraform, Helm
Orchestration: Kubernetes, Docker
Deployment & Repository: GitHub Actions, ArgoCD
Monitoring & Logs: OpenTelemetry, Elastic, Prometheus, Grafana
Datastore: PostgreSQL, Elasticsearch
Queuing: Redis, Kafka, AMQP
Programming language: Java, TypeScript (you read it; you don't need to write it daily)
5+ years in SRE, platform, or infrastructure engineering, with production ownership of the systems you built.
Deep, production-grade Kubernetes expertise: you have operated multiple production clusters and know where they break (upgrades, configuration drift, networking, resource sizing).
Strong Google Cloud experience: GKE, IAM, networking (VPC, private clusters, load balancing), and managed data services. Equivalent depth on AWS or Azure is not a substitute here.
Strong Terraform: you have built reusable modules and managed state across many environments, not just written resources.
Ability to design and document: you can show design docs or RFCs you wrote and explain the trade-offs you made.
Real on-call and incident experience, including writing postmortems and turning them into durable fixes.
SaaS operations background: you have run production systems for paying customers, with SLOs that mattered.
Fluent in English and comfortable working autonomously in a fully remote environment.
Pragmatism: you pick the boring solution when it works and can explain why.
Experience running workloads that execute untrusted or user-defined code (sandboxing, gVisor, node pool isolation).
Built or operated a fleet control plane for per-customer environments (Kubernetes operators, Crossplane, GKE Fleet / Config Sync, or custom provisioning services).
FinOps practice on GCP: per-customer cost attribution, committed use discounts, spot node pools.
Exposure to SOC 2 or ISO 27001 audits from the infrastructure side.
Familiarity with workflow orchestration (Kestra, Airflow, Temporal, or similar) or the JVM in production.
Month 1: onboard on the current Kestra Cloud architecture, ship your first changes to production, and shadow on-call.
Months 2 to 3: take ownership of a first area (for example provisioning automation or observability), and contribute to the GA architecture spec and SLOs with the Lead SRE.
Months 4 to 6: deliver your part of the first GA milestones (one-click provisioning of a customer instance, observability coverage, safe upgrade path) and join the on-call rotation as a full member.
After month 6: own components of the platform end to end and drive their continuous improvement, including the re-architecture of the first version of Kestra Cloud based on what Beta and the first GA customers taught us.
Work from anywhere: We're a remote-first company, so you can work from wherever feels like home. Plus, you'll have access to coworking spaces worldwide if you ever need a change of scenery.
Health coverage: From medical support, dental, and vision, we've got you covered.
Home office setup on us: We'll provide all the equipment you need to work comfortably.
We aim to move quickly (2-3 weeks), but we can adjust the timeline if needed.
Intro call with our CEO (30 min)
Technical scenario / Practical assessment (2 hours, asynchronous: write a short design spec for a Kestra Cloud scenario on GKE and Terraform, and implement one part of it)
Technical review with our CTO, walking through your spec, your code, and the trade-offs (45 min)
