Make Secure Device Updates Reliable at Fleet Scale

Northern.tech builds products that help secure and manage connected devices throughout their lifetime.

The company is behind Mender, an open source platform for over-the-air software updates; CFEngine, a configuration and compliance automation product; and Alvaldi, a secure remote troubleshooting product.

Together, these products are deployed across millions of devices. To put the operating scale in context, a public 2025 incident report described Hosted Mender alone as managing more than 500,000 active devices. Those fleets include gateways, cameras, vehicles, satellites, and other connected systems that need to remain secure, maintainable, and dependable long after they are deployed.

Northern.tech invests heavily in engineering and R&D, maintains core technology in the open, and works as a distributed international team.

Reliability here is not an abstract percentage.

Hosted Mender is a continuously operated platform that helps organizations deliver and manage software across connected-device fleets.

The service brings together cloud infrastructure, Kubernetes, stateful systems, deployment automation, security, and device behavior at the edge. The devices may be remote, intermittently connected, or operating in environments where an unsafe update has real consequences.

You will extend the team's operational coverage and work on the systems behind the service. The job does not end when production recovers: you will turn incident evidence into automation, observability, safer changes, and fewer recurring problems.

That work affects whether organizations can securely manage devices that may be far away, difficult to access, and expected to work for years. A problem in the hosted platform can cross several dependent service, infrastructure, data, and device layers at the same time.

• Improve the security, reliability, and performance of Northern.tech's core hosted services, with Hosted Mender as the immediate operational focus.
• Participate in the on-call rotation, diagnose ambiguous production failures, lead incidents at the appropriate level, and help services recover safely.
• Run blameless post-incident reviews and turn findings into preventive work, tests, automation, or clearer operational practices.
• Design, build, and maintain automated infrastructure and deployment pipelines using infrastructure as code.
• Improve observability across metrics, logs, and traces so alerts lead to useful action and customer impact can be understood quickly.
• Make production changes safer across Kubernetes workloads and stateful dependencies, including rollout, rollback, upgrades, migration, backup, and recovery within your scope.
• Improve capacity planning, workload isolation, rate limiting, backpressure, and failure containment for bursty, multi-tenant traffic.
• Integrate security into design, deployment, access, monitoring, vulnerability response, and incident handling, and contribute to Northern.tech's security work.
• Partner with engineering, product, security, Customer Engineering, and support teams on reliability goals and production trade-offs.
• Provide first-line internal support and second- or third-line support for customer issues within the agreed service boundaries.
• Manage service access and user policies with appropriate security controls.
• Identify cloud-cost improvements without weakening reliability, performance, or security.
• Build maintainable software and automation instead of relying on repeated manual work.

You do not need to have used every named tool below. You do need enough systems depth to understand how the layers interact and to learn the unfamiliar parts.

The confirmed role baseline includes:

• managed Kubernetes in production
• strong experience in at least one major cloud and the ability to transfer that judgment across a multi-cloud context
• infrastructure as code, with Terraform preferred and CloudFormation relevant
• metrics, logs, traces, and alerting, with Prometheus and Grafana among the current examples
• CI/CD; GitHub Actions and GitLab CI are examples of relevant systems
• Bash or Python for automation, with Go useful for deeper engineering work
• security-sensitive access, software delivery, and vulnerability response

Public Mender architecture provides additional context: production installation patterns include EKS, AKS, or GKE and stateful dependencies such as MongoDB, Redis, NATS, and object storage. The exact Hosted Mender topology and the components this hire will own will be confirmed during the process.

Northern.tech gives people room to think and act. That does not mean working alone.

Autonomy works when information is shared, decisions have clear owners, and people ask for help before uncertainty becomes hidden risk. The team values people who make others more successful, not only people who collect individual wins.

The company prefers continuous improvement over large one-off initiatives: small, observable, reversible changes; fast feedback; visible metrics; and automation that removes unnecessary work. The goal is not heroics. Failures should be discussed openly and used to improve the system rather than assign blame, with learning that survives the incident.

In practice, we expect you to:

• explain your assumptions and show the evidence behind a decision
• share context early enough for teammates to help
• make progress without waiting for perfect instructions
• change your mind when production data contradicts the first hypothesis
• leave the service, documentation, and team better prepared than before

These are the priorities Northern.tech currently expects for the role. The team will confirm the exact objectives and measures during the process.

Within your first 90 days, you should be able to explain the architecture, dependencies, deployment paths, access model, incident history, runbooks, support boundaries, and on-call handoffs. You should also be contributing safely during real production work and have shipped one meaningful improvement that removes recurring toil or reduces a known risk.

Over time, success looks like:

• fewer repeat incidents and avoidable pages
• faster, calmer diagnosis and recovery when something does fail
• safer and more reversible infrastructure, application, and data changes
• observability that explains customer impact instead of producing noise
• better containment of tenant, workload, and dependency failures
• tested recovery practices rather than recovery plans that exist only on paper
• clear handoffs and stronger coverage across time zones
• engineering teams able to ship and operate services with less manual SRE work
• cloud-cost decisions made with reliability and security trade-offs visible

We care more about evidence of ownership than a perfect title or a list of technologies.

You may be a strong fit if you can show:

• direct responsibility for diagnosing and resolving ambiguous incidents in live distributed systems
• hands-on Kubernetes operations at meaningful production scale, including networking, workloads, rollouts, autoscaling, resource isolation, capacity, and failure modes
• strong production experience with at least one major cloud and infrastructure as code
• practical use of metrics, logs, traces, alerting, and automation to improve a service, not only install tooling
• solid Bash or Python and evidence of maintainable engineering beyond ad hoc scripts
• an understanding of how applications, gateways, load balancers, TLS, Kubernetes, data stores, caches, queues, and deployment changes affect one another
• experience operating at least one production database, cache, or message broker, with sound judgment around migration, retry behavior, backup, recovery, and rollback
• security-conscious production decisions involving access, secrets, vulnerabilities, delivery, threat modeling, or compliance
• clear professional English and the ability to communicate during incidents, across time zones, and in internal or customer-facing support situations
• autonomy paired with transparency, useful written handoffs, and respect for peer review

For the preferred Costa Rica and wider Latin America coverage, Northern.tech needs an SRE senior enough to make sound production decisions independently during Americas hours. Five or more years in SRE or a closely related role is a useful indicator, but demonstrated ownership matters more than the number itself.

This regional coverage extends the team's working day by approximately eight hours. It is shared ownership across time zones: you will have room to act during Americas hours and be expected to leave clear context, decisions, and handoffs for colleagues coming online in Europe.

For candidates in Europe, Northern.tech is also open to a strong SRE with roughly three to five years of relevant experience, solid foundations, and a clear upward trajectory. The existing SRE can provide more direct mentorship in that timezone.

Candidates elsewhere in Latin America may be considered when location, contracting, and working-hour coverage are workable.

• Go and production software development beyond operational scripting
• MongoDB, Redis, NATS, or comparable datastore, cache, and broker experience
• Helm, Kustomize, GitOps, or platform-engineering work
• safe online migrations, point-in-time recovery, and tested disaster recovery
• load, upgrade, synthetic, resilience, or controlled failure testing
• multi-tenant rate limiting, backpressure, or noisy-neighbor isolation
• open source contribution or maintenance
• SOC 2, GDPR, SLSA, supply-chain security, bug bounty, or structured vulnerability-response experience
• multi-cloud operations or customer-driven regional constraints
• B2B SaaS at scale, IoT, fleet/device management, embedded Linux, OTA updates, or another security-sensitive environment
• cloud-cost optimization tied to measurable service trade-offs

There is no single required career path. Relevant backgrounds may include:

• Site Reliability Engineer who has owned incidents and systemic prevention
• Cloud DevOps Engineer with deep Linux, Kubernetes, and automation experience
• Platform Engineer who remained close to production and on-call work
• Production Engineer who writes software and reasons across service layers
• Systems Engineer who moved from infrastructure operations into cloud-native reliability engineering
• Backend or infrastructure engineer with strong production, deployment, and operational ownership

• you want a role limited to watching dashboards and passing tickets to another team rather than combining incident response, platform engineering, security, infrastructure as code, support, and live-service improvement
• you want an operations role limited to routine administration or ticket execution
• you do not want to participate in on-call or customer-impacting incident work
• you reach for restarts or familiar tools before establishing the topology, recent changes, and evidence
• your Kubernetes, cloud, or observability experience is mostly conceptual and you cannot explain a real production decision you owned
• you prefer repeated manual fixes to writing software, automation, or durable root-cause improvements
• you want autonomy without transparent decisions, written handoffs, peer input, or responsibility for consequences
• the required timezone coverage or a mandatory background check does not work for you

• A base in the range of USD 80,000 to 120,000, depending on geography and level.
• Meaningful production ownership within Hosted Mender, where reliability decisions affect remote fleets that may be difficult to access physically.
• Technical depth across Kubernetes, multi-cloud infrastructure, stateful services, security, observability, incident response, and software delivery.
• An engineering culture built around small, observable, reversible changes, useful automation, and learning from failure instead of heroics.
• An international remote environment with a flat hierarchy, clear ownership, and room to shape how the platform is operated.
• Close collaboration with an experienced SRE and engineers working across Mender's hosted platform and open source ecosystem.
• Support for learning through books, conferences, workshops, and internal knowledge sharing.
• Flexible working practices, vacation, and family support, with exact terms depending on country and engagement model.
• Periodic opportunities to meet colleagues for engineering work, product planning, and company gatherings.

The process is designed to understand how you reason about real systems, decisions, and trade-offs, not how many definitions or tool names you can repeat.

You can expect:

• an initial recruiter screen with TalentFlank
• an approximately 30-minute technical screen
• a practical technical exercise
• a review of that exercise with Northern.tech interviewers
• a culture and leadership conversation

The team will explain the scope and expectations before each stage.