Site Reliability Engineer - Cloudflare & Ingress - Core Infrastructure

Overview

Building the Future of Open Finance. Payward - the parent company behind Kraken, Ninja Trader, Breakout, xStocks, Payward Services and CF Benchmarks - has spent the last 15 years building one of the most modern and globally accessible financial infrastructure platforms in the industry, built to advance an open, global financial system.

Before you apply, we encourage you to explore our culture page to understand what drives us and how we work. The team:
Kraken is one of the world’s longest-standing crypto platforms, trusted by over 10 million individuals and institutions across the globe. It offers spot trading, margin, futures, staking, and OTC services, with products built for both individual investors and institutional clients.

• Join the engineering team as a Senior Site Reliability Engineer focused on the edge and ingress layer that fronts our platform. Own the design, hardening, and operation of our Cloudflare edge configuration and our ingress/reverse-proxy stack, ensuring traffic reaches our applications securely, reliably, and at scale.
• Guarantee the availability, performance, low-latency, security, and cost efficiency of our edge and ingress infrastructure. Improve operational excellence for how traffic enters and moves through our environment; mentor other engineers and raise the bar on edge and ingress reliability practices.
• Own and evolve Cloudflare edge configuration across Accounts and Zones, including WAF rules, custom Rulesets, Bot Protection, and Rate Limiting policies.
• Design and maintain DNS architecture in Cloudflare, including zone delegation, record hygiene, and change management at scale.
• Implement and operate mTLS with Authenticated Origin Pulls, private PKIs, and manage the certificate lifecycle across Cloudflare and origin infrastructure.
• Build and support self-service automation for edge configuration using Terraform, enabling application teams to safely manage their own WAF, DNS, and routing changes.
• Develop and operate solutions using Cloudflare Workers and R2 Storage to extend edge logic and reduce origin load.
• Own the ingress and reverse-proxy layer, including HAProxy OSS and HAProxy Fusion (enterprise), covering TLS termination, mTLS, TCP passthrough, proxy-protocol handling, HTTP/HTTPS/FIX protocols.
• Design and manage reverse proxy topologies and load balancing across AWS Load Balancers, AWS Direct Connect, AWS Private Link and similar solutions for hybrid on-premises/cloud connectivity.
• Build, operate, and improve Kubernetes ingress controllers, and design/write Kubernetes Operators and CRDs to automate ingress and routing configuration as code.
• Operate and extend service mesh (Istio) capabilities, including traffic management, mTLS between services, and observability of east-west traffic.
• Partner with Security to defend against OWASP-class attack vectors, implement credential-stuffing protection, DDoS prevention, and manage ACLs across the edge and ingress layers.
• Implement robust monitoring and alerting for edge, DNS, and ingress health to proactively detect anomalies, latency regressions, and abuse patterns.
• Lead incident response for edge/ingress-related incidents and participate in on-call rotations, including postmortems and runbook development.
• Document architecture, standards, and best practices for the edge and ingress layer, and mentor other engineers on Cloudflare and ingress operations.
• Act as the primary subject matter expert for Cloudflare, ingress, and edge networking, providing weekly support to engineering teams through office hours, support requests, architecture guidance, technical coaching, and hands-on assistance to unblock projects and enable successful adoption of platform capabilities.

• 3+ years of experience as a Site Reliability Engineer, Cloudflare Engineer, Platform/Infrastructure Engineer, or similar role, with meaningful ownership of edge, CDN, or ingress systems.
• Hands-on production experience with Cloudflare, including WAF/Rulesets, Bot Protection, Rate Limiting, DNS, Zones/Accounts administration, and certificate management.
• Production experience operating HAProxy (OSS and/or Fusion) or comparable reverse proxies, including TLS termination, TCP passthrough, and proxy-protocol.
• Experience with AWS networking primitives:
  Direct Connect, Load Balancers (ALB/NLB), and VPC routing/connectivity patterns.
• Working knowledge of service mesh technology (Istio or equivalent) and its role in traffic management and mTLS.
• Experience operating Clo