Backend / Systems Engineer

About the role

You will work in Go on the parts of the product that have to be correct and fast: the edge proxy that terminates TLS and reverse-proxies customer traffic, the on-demand certificate issuance that happens inside the handshake, and the DNS and verification services that decide whether a domain is really ready. When a connection is slow or a certificate fails to issue, you are the person who finds out why.

Responsibilities

• Own the reverse-proxy edge: TLS termination, request routing, connection handling, and the latency and reliability budgets that go with serving other companies' traffic.
• Build on-demand TLS so certificates are issued and renewed inside the handshake through ACME, with no manual step for the end-user.
• Work on the DNS layer: querying provider state, confirming records propagated, and handling apex domains and the awkward cases providers create.
• Run drift monitoring that catches a record that changed or a certificate about to lapse, and fire the webhook before the customer notices.
• Set up the observability, load testing, and alerting that let a small team trust the edge in production.

Requirements

• You are fluent in Go and have built networked services that stay up under real traffic.
• You know TLS, certificates, and ACME well enough to debug a failed handshake or a renewal that did not fire.
• You understand DNS beyond the basics: propagation, caching, apex versus subdomain, CNAME and ALIAS behavior across providers.
• You have run a proxy, load balancer, or edge service in production and have opinions about timeouts, retries, and backpressure.

Skills

• Bonus: You have implemented an ACME client or worked directly with a certificate authority's issuance flow.
• Bonus: You have operated infrastructure that terminates TLS for domains you do not own.
• Bonus: You have profiled and cut tail latency in a Go service.