Staff Engineer, Software Distribution onPrem

Qevlar is a B2B SaaS scale-up on a mission to boost the productivity of cybersecurity teams with Artificial Intelligence. We build an AI platform that transitions Security Operations Centers from reactive to proactive units through autonomous security alert investigations.

In just three years, we have:

• Raised a total of $44m in series-A & seed rounds from EQT Ventures, Forgepoint Capital and Partech

• Deployed our solution with major Enterprises such as Sodexo and Global Connect, and leading MSSPs like Orange Cyberdefense

• Expanded to the US market with a growing North American presence

• Ended 2025 with a strong multi-million dollar ARR and ambitious goals for 2026

We are launching Qevlar on-premise for customers who cannot let their security data leave their perimeter. Your job is to turn a signed bundle into a running production platform inside their data centre, and to make each deployment faster than the last.

On these accounts the critical path is rarely the software. It is the security review board, the firewall change request, the PKI team, the change advisory board. Someone has to own that path, with enough technical credibility to be taken seriously by the customer's infrastructure architects: this is your role.

• Decide what we do not port. Your first deliverable is the on-prem reference architecture and the explicit list of dependencies, services and features that will not cross the boundary. You will hold that line against the rest of engineering, with our backing.

• Ship the bundle. A Helm chart and an air-gapped tarball that install on vanilla Kubernetes and on Open Shift, with no internet access, in under four hours — by someone who has never seen our code and has only your documentation.

• Replace the cloud underneath us. Self-hosted Postgres, S3-compatible object storage, secret management, identity federation — behind abstractions clean enough that we never fork the product or let on-prem drift away from SaaS.

• Package and size the inference layer. Our platform runs agentic investigations, which means sustained LLM throughput. You own the serving stack in the bundle, the VRAM and concurrency sizing matrix customers use to provision their own GPUs, and the distribution and rollback of model weights across an air gap.

• Build the test harness that makes releases boring. Ephemeral customer-shaped environments, install and upgrade smoke tests across Kubernetes distributions, identity providers and network modes — until validating a release candidate takes a day, not a week.

• Ship clean. Signed images, SBOMs, minimal base images, no critical or high CVEs  buyers are security teams; they will scan everything we hand them on day one.

• Impose the upgrade contract on the whole org. Tested N-3 upgrade paths, backward-compatible migrations, no feature merged without a feature flag, a health check and a support-bundle contribution. Customers will jump from a year-old release straight to the latest, and it has to work.

• Keep it boringly simple. A product that ships self-hosted cannot grow a new managed dependency every quarter. You get explicit veto power, and you will need it.

You have:

• Shipped software that someone else installs. This is what we screen hardest on. Operating your own cluster is a genuinely different discipline from handing an artifact to a stranger who runs it on infrastructure you will never see.

• Deep Helm expertise — subcharts, conditional templating, values design — plus OCI registries and real exposure to Kubernetes beyond a single distribution:
  Open Shift and its SCCs, vanilla, RKE2, k0s, whatever you had to survive.

• Worked in air-gapped or heavily restricted environments: image mirroring, offline bundles, egress proxies, custom CA bundles, no…