Kubernetes Platform Engineer - Networking & Security

CloudFerro builds cloud technologies used by Europe's leading scientific institutions and space organizations such as ESA, EUMETSAT, ECMWF, Mercator Ocean International, DLR, and EGI. The company is building a sovereign European cloud platform from the ground up, based on a Kubernetes-based, open-source PaaS stack covering serverless computing, managed databases, MLOps, monitoring, and observability.

• Proven experience designing and implementing Kubernetes networking in production multi-tenant environments.
• Deep knowledge of Cilium or Calico, including configuration, troubleshooting, and eBPF.
• Hands-on experience with Kubernetes Network Policies and multi-tenant isolation.
• Experience with OPA/Gatekeeper or Kyverno, including writing and maintaining security policies.
• Strong Go programming skills and working knowledge of Python for developing admission controllers, webhooks, or Kubernetes operators.
• Comfortable using AI-assisted development tools (e.g., Claude Code, GitHub Copilot) in engineering work.

Nice to have:

• Experience with Ingress controllers such as NGINX, Envoy, Cilium Ingress and load balancing.
• Experience with service mesh technologies like Istio, Linkerd, Cilium Service Mesh.
• Strong understanding of Kubernetes security practices including Pod Security Standards, seccomp, AppArmor, and container image scanning.
• Knowledge of BGP, VXLAN, and WireGuard in overlay networking environments.
• Experience managing DNS in multi-tenant Kubernetes clusters using CoreDNS and ExternalDNS.
• Certified Kubernetes Security Specialist (CKS) certification.
• Experience with security audits and compliance frameworks such as SOC 2 or ISO 27001.
• Experience operating HashiCorp Vault on Kubernetes.

• Design, implement, and maintain the platform networking architecture including CNI, Ingress, and Load Balancing.
• Design and enforce multi-tenant network isolation.
• Build and maintain admission controllers and policy engines (such as OPA/Gatekeeper or Kyverno).
• Review networking architecture for new platform services and components.
• Implement security hardening practices including image scanning pipelines, Pod Security Standards, and RBAC reviews.
• Integrate Kubernetes networking with the underlying IaaS infrastructure.