Lead Tech SRE - Kestra

About Kestra

Kestra is the universal orchestration platform: open source, declarative, and designed to orchestrate data pipelines, IT automation, business workflows, and AI/agentic systems.

Trusted by over 10,000 organizations worldwide, including JPMorgan Chase, Bloomberg, FILA, and Crédit Agricole, Kestra orchestrates mission-critical workloads at scale. The open-source project has close to 30,000 GitHub stars, hundreds of contributors, and a fast-growing global community.

About the Role

Kestra Cloud is our fully managed SaaS edition of Kestra. Each customer gets a dedicated Kestra instance on dedicated infrastructure, so the platform is a fleet of isolated stacks rather than one shared cluster. It is in Beta today, running production workloads for early customers, with General Availability planned for 2027. Each instance runs arbitrary user code (scripts, containers, queries against their own systems) through hundreds of plugins, and the fleet grows with every new customer. Provisioning, upgrading, and observing dozens to hundreds of identical stacks without drift is the core problem.

We're looking for a Lead Tech SRE to own Kestra Cloud end to end: the architecture and specs, the delivery, the monitoring, and the continuous improvement of the platform. You decide how the platform should evolve, write it down, split it into work, and ship it with your team.

You will lead a team of three, yourself included. That means you stay hands-on (a large share of your week is Terraform, Kubernetes manifests, and incident work) while setting the technical direction, reviewing designs, and dispatching work to two SREs.

You will work closely with the CTO, the platform engineering teams building the Kestra core, and our security engineer. This is an engineering leadership role, not a people-management-only one.

Responsibilities

Architecture & Specs

• Own the target architecture of Kestra Cloud on GCP: the per-customer dedicated stack (cluster, network, databases, queues), templating, versioning, regions, and the path from Beta to GA.
• Write the specs (design docs, RFCs, ADRs) that turn product needs into infrastructure work, defending trade-offs: cost per customer vs isolation level, GCP project vs cluster vs node pool per customer, managed service vs self-run.
• Define SLOs and error budgets per service and per tier, making them the basis for prioritization.

Delivery

• Break specs into work and dispatch it across the team, then review and unblock. Set the bar for Terraform modules, Helm charts, and GitOps conventions.
• Automate the customer instance lifecycle: provisioning, upgrades, scaling, backups, migration, and decommissioning, with no manual steps.
• Own the release path of Kestra Cloud with ArgoCD and GitHub Actions: progressive rollouts, rollback, and upgrade safety across the entire fleet of customer instances.

Monitoring & Operations

• Build the observability stack (metrics, logs, traces, alerting) so issues are caught before customers report them.
• Run on-call and incident response for the team: rotation, runbooks, blameless postmortems, and follow-ups that ship.
• Plan capacity for bursty workloads and maintain accurate autoscaling.

Continuous Improvement

• Drive cost efficiency (FinOps) on GCP: per-customer cost visibility, right-sizing, committed use, and spot instances.
• Harden the platform alongside the security engineer: network policies, workload identity, secrets, and audit trails aligned with SOC 2 expectations.
• Feed back into the product: identify when Kestra itself makes cloud operations difficult, propose fixes, and collaborate with core engineering to land them.

Tech Stack

• Cloud: GCP (GKE, Cloud SQL, GCS, Cloud Load Balancing, IAM / Workload Identity)
• Infrastructure as Code: Terraform, Helm
• Orchestration: Kubernetes, Docker
• Deployment & CI/CD: GitHub Actions, ArgoCD
• Monitoring & Observability: OpenTelemetry, Elastic, Prometheus, Grafana
• Datastores & Queuing: PostgreSQL, Elasticsearch, Redis, Kafka, AMQP
• Languages: Java, TypeScript (reading comprehension; daily authoring not required)

Requirements

• 8+ years in SRE, platform, or infrastructure engineering, including at least 2 years leading the technical direction of a team or platform.
• Deep, production-grade Kubernetes expertise operating fleets of clusters at scale (upgrades, configuration drift, networking, resource sizing).
• Strong Google Cloud experience: GKE, IAM, networking (VPC, private clusters, load balancing), and managed data services.
• Expert Terraform skills designing scalable module structures and multi-tenant/multi-environment state layouts.
• Proven ability to architect, spec, and dispatch work through clear design documentation.
• Solid on-call and incident management experience, including running postmortems.
• SaaS operations background supporting paying customers with strict SLOs.
• Fluent in English with the ability to work autonomously in a remote setup.
• Pragmatic approach to engineering, favoring boring, reliable solutions.

Nice to Have

• Experience executing untrusted or user-defined code (sandboxing, gVisor, node pool isolation).
• Experience building or operating fleet control planes (Kubernetes operators, Crossplane, GKE Fleet / Config Sync, or custom provisioning services).
• FinOps experience on GCP (cost attribution, committed use discounts, spot instances).
• Exposure to SOC 2 or ISO 27001 compliance and audits.
• Familiarity with workflow orchestration tools (Kestra, Airflow, Temporal) or the JVM in production.

Perks & Benefits

• Work from Anywhere: Remote-first culture with access to worldwide coworking spaces.
• Health Coverage: Comprehensive medical, dental, and vision support.
• Home Office Setup: Equipment provided to ensure a comfortable remote setup.

Hiring Process

• Intro call with CEO (30 min)
• Technical scenario / Practical assessment (2 hours, asynchronous: design spec for Kestra Cloud on GKE/Terraform)
• Architecture review with CTO (45 min)