Software Engineer (Python) — Programmable Networking

Role overview

A focused engineering team owns networking as an API product end-to-end: the public REST surface, the orchestration control plane, and the automation that programs routers across multiple global points of presence. The role sits at the seam between software and network engineering, designing API resources, writing orchestration code that turns HTTP requests into network deployments, and owning the routing configuration rendered onto the fleet. Work spans developer-facing specifications down to running config on each device.

Responsibilities

- Design and evolve public REST endpoints for private networks, virtual cross-connects, WireGuard interfaces and peers, global IPs, and public internet gateways, including OpenAPI 3 specs, gateway routing, and backward compatibility for live customers - Build an async orchestration control plane (Python 3.12, asyncio) translating API calls into deployments: resource allocation, Postgres-backed job queues with SKIP LOCKED, retries, rollback on partial failure, and reconciliation daemons - Drive network automation through Ansible and SSH libraries, pushing Jinja2-templated config to Linux and VyOS nodes, covering WireGuard lifecycle, FRR/VyOS BGP, GRE tunnels, static NAT, firewall rules, Unbound DNS, and anycast announce/withdraw - Integrate cloud interconnect providers' APIs to land virtual cross-connects into AWS, Azure, and Google Cloud regions - Operate an Envoy-based data plane with a Go xDS control plane pushing CDS/RDS/EDS over ADS to edge and gateway fleets - Own production concerns: metrics and alerting, error tracking, customer escalations across app and network layers, and billing sync for network resources

Requirements

- Experience building and operating customer-facing REST APIs over real infrastructure, where a POST ends in a device being configured, with comfort handling async-job, rollback, and eventual-consistency challenges - Strong production experience with async Python and comfort writing and reviewing Go - Working routing knowledge: configure and debug BGP sessions, VRFs, GRE tunnels, NAT, and WireGuard; read FRR or VyOS configs - Postgres beyond ORM basics: migrations on live systems, locking semantics, queue patterns - Fleet automation over SSH at production scale: Ansible, idempotent roles, safe rollout, drift detection - Ability to debug incidents across layers in one sitting, from tcpdump and wg show to application logs, knowing whether the fix is code or config

Nice to have

- Envoy or xDS control-plane work using go-control-plane and ADS snapshots - Cloud interconnect product experience with AWS Direct Connect, Azure ExpressRoute, GCP Partner Interconnect, or Equinix Fabric/Metal provisioning APIs - IPAM internals such as NetBox or equivalent, plus address-plan and route-distinguisher design - Linux-to-VyOS or equivalent network OS migration on live customer traffic - Mobile core exposure, including routing toward PGW/PCEF/EPC and GRE toward packet gateways - OpenAPI spec authorship and public developer documentation - Operating multi-site PoP fleets across bare metal and colocation facilities