Forward Deployed Engineer - Smallstep

Smallstep is an internationally distributed, remote-first company. We work reasonable, flexible hours and utilize technology to accomplish goals asynchronously. We look for folks who are thoughtful, can break down problems, and often work independently. You are trusted to work on your own and to ask for help when blocked.

Security is a core responsibility for all employees at Smallstep. All roles are expected to strictly adhere to our security policies, procedures, and best practices to protect company assets, customer data, and systems.

We're looking for a Forward Deployed Engineer to embed with customers deploying Smallstep's device identity platform and get them to production. The most common use cases are securing Wi-Fi, browser mTLS, SSH, VPN and other network-based communication using credentials issued by Smallstep’s agent or an MDM.

Responsibilities

• Diagnosing and resolving technical failures blocking deployments
• Acting as the technical escalation point for Technical Account Managers and Customer Success Engineers when a deployment needs deeper engineering involvement
• Shipping production Golang code to resolve root causes uncovered during deployment debugging
• Building proof-of-concept environments, using Bash and Terraform, and runbooks for new product surfaces ahead of polished UX
• Setting day-to-day priorities and assignments for Smallstep's deployment ops engineers
• Carrying a formal on-call rotation with defined SLAs
• Maintaining a high level of customer experience and a service mindset during implementation challenges
• Growing the role over time into an even split between resolving live deployments, building reusable runbooks, and validating new use cases through proofs of concept

Experience With

• Debugging distributed, multi-service cloud architectures in live customer environments
• Troubleshooting TLS/mTLS at the protocol level, including certificate chain validation, trust stores, and handshake failures
• Production experience with certificate-based authentication, VPNs, enterprise Wi-Fi/EAP-TLS, RADIUS, SSH, OAuth
• Developing and shipping production Golang code
• Owning technical escalations directly with customers, in partnership with account teams

Nice to Have

• Familiarity with certificate enrollment protocols such as SCEP and ACME DA
• PKI experience across macOS, Windows, Linux, and ChromeOS
• Experience with hardware-backed security mechanisms such as Yubikeys, TPMs, HSMs, or secure enclaves
• Experience carrying a formal on-call rotation with SLAs
• Prior experience in a customer-facing technical role, such as a forward deployed engineer or solutions engineer

Technologies

• Languages & Tools: Golang, Bash, Terraform, Git, GitHub Actions
• Protocols & Standards: SCEP, ACME, SCIM, mTLS, EAP-TLS, RADIUS, PKI, X.509, SSH, TPMs
• Operating Systems: macOS, Windows, Linux, ChromeOS
• Infrastructure: MDMs (Jamf, Intune, Workspace One, Google Workspace Admin, Iru), Wi-Fi/RADIUS, VPNs