Secure overlay networking, private service discovery, and attributable network paths. Why this roleYou will work directly with the CTO on a network design being made now rather than inherited, which means your judgment shows up in the architecture. What you will own- Secure overlay networking and private service discovery across WireGuard, IPv6, DNS, routing, and nftables.- Least-privilege ingress and egress policy enforced at the edge.- Attributable protected paths with explicit authorization, expiration, revocation, and evidence.- Transparent egress controls, network visibility, incident diagnosis, and durable runbooks. What we need- Hands-on production experience with IPv6, routing, DNS, service discovery, and firewall policy.- WireGuard in production; Tailscale, Headscale, or a comparable secure overlay is a strong signal.- Production Linux and container infrastructure experience.- Working knowledge of mTLS, certificate enrollment, rotation, revocation, keys, and access control. Compensation$130K–$170K. Potential equity, 401(k), and 100% paid family medical, dental, vision, and life insurance.