Job Description:

• Design, configure, and tune Envoy in production: L7 routing, filter chains, mTLS, rate limiting, observability.
• Build security modules with Proxy-Wasm (Rust) or ext_authz/ext_proc; update configs dynamically via xDS with zero service disruption.
• Integrate OAuth2/OIDC (token issuance/validation, SSO) and PKI/mTLS for secure access.
• Run Kubernetes on-prem and in the cloud: deployment, scaling, networking, HA/DR.
• Apply DevOps/GitOps: CI/CD, Terraform-based IaC, automated build-deploy-rollback.
• Handle certificates/secrets, TLS/mTLS, and vulnerability scanning; troubleshoot Linux/network issues; monitor metrics/logs/traces; lead RCA/postmortems; meet SLA/SLO targets.
• Align with the client-side team on solutions at the client-gateway boundary.
• Implement agreed protocol trade-offs at the gateway: QUIC/HTTP-3, HTTP/2, TLS termination, internal CA.
• Lead the area: assign tasks, review code, and mentor Cloud/Backend engineers.
• Partner with Security, PM, and customers; write and maintain technical/design docs

Requirements:

• Hold a Bachelor’s degree in IT, electronics and telecommunications, or a related field.
• Have at least 5 years in backend/infrastructure engineering, including experience in a technical lead or senior role.
• Have production Envoy experience (routing, filter chains, mTLS, observability), including extending Envoy via Wasm or ext_authz/ext_proc.
• Demonstrate deep knowledge of networking (L4/L7, TLS/mTLS, PKI, DNS, and load balancing) strong Linux skills; and experience with distributed systems on Kubernetes (deployment, scaling, networking, HA).
• Deliver zero-downtime config updates via xDS.
• Show proficiency in at least one backend language (Go/Rust/C++/Java...), with strong code reading, modification, and debugging. Fundamentals (concurrency, networking) matter more than syntax.
• Know OAuth2/OIDC and basic PKI (Keycloak/Vault/OpenBao).
• Work with CI/CD and Terraform/IaC.
• Take strong ownership of production systems, with security and automation as first principles.
• Propose alternatives with trade-offs when blocked technically, rather than stopping at “not feasible.”
• Understand the intent behind customer requests; communicate effectively and guide Dev/QA/PM.

Preferred:

• Have experience with service mesh and DR.
• Know Envoy Gateway / Gateway API.
• Have experience with dynamic forward proxy.
• Be familiar with Go and Rust (Wasm), with the ability to ramp up quickly.
• Have experience implementing a full Zero-Trust architecture.
• Have advanced GitOps experience, plus AWS/Azure.
• Have in-depth knowledge of QUIC/HTTP-3.

• 12 annual leave days, along with public holidays in accordance with Vietnamese labor law
• Bonuses on special occasions such as the company anniversary and Lunar New Year
• Year-end bonus based on business performance and individual evaluation
• Participation in large-scale annual company events
• A variety of sports activities to promote health and team bonding
• Diverse internal clubs
• Modern open-plan working environment with fully equipped facilities
• Free training programs covering both professional and soft skills
• Opportunities to learn Japanese in person, from beginner to advanced levels, with a strong focus on speaking practice
• Free access to online courses on the Udemy platform
• Financial support for professional certification exams and rewards for earning advanced certifications
• Opportunities to grow into an internal trainer role with competitive compensation