SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Qevlar AI is a B2B SaaS scale-up building an AI platform that helps cybersecurity teams transition from reactive to proactive operations through autonomous security alert investigations. The company has raised $44M from top-tier VCs (EQT Ventures, Forgepoint Capital, Partech), deployed with major enterprises like Sodexo and GlobalConnect, and ended 2025 with multi-million dollar ARR.
You will own the on-premises distribution strategy for Qevlar's platform, enabling customers who cannot allow security data to leave their perimeter to deploy and run the solution in their own datacenters. This is a high-impact architectural role with explicit veto power over technical decisions.
Key responsibilities:
- Define and own the on-premises reference architecture, explicitly deciding which dependencies, services, and features will not be ported, and defend that boundary against the broader engineering organization.
- Ship production-ready distribution artifacts: a Helm chart and air-gapped tarball that install on vanilla Kubernetes and OpenShift with no internet access in under four hours, usable by someone unfamiliar with the codebase.
- Abstract cloud infrastructure (Postgres, S3-compatible storage, secret management, identity federation) behind clean interfaces to prevent product forking and on-premises drift from SaaS.
- Own the inference serving stack for the bundle, including VRAM and concurrency sizing matrices for GPU provisioning, and manage model weight distribution and rollback across air gaps.
- Build a comprehensive test harness that makes releases routine: ephemeral customer-shaped environments, install and upgrade smoke tests across Kubernetes distributions, identity providers, and network modes.
- Enforce supply chain security: signed images, SBOMs, minimal base images, zero critical/high CVEs at release.
- Impose upgrade contracts across the organization: tested N-3 upgrade paths, backward-compatible migrations, feature flags, health checks, and support-bundle contributions so customers can jump from year-old releases to the latest without breaking.
- Maintain architectural simplicity by exercising explicit veto power over new managed dependencies.
This role requires someone with deep expertise in shipping software that others install—a fundamentally different discipline from operating your own cluster. You will work in a small, international, fast-moving team where your contributions directly shape the company's success.
Requirements:
- Shipped software that someone else installs (this is the primary screening criterion).
- Deep Helm expertise: subcharts, conditional templating, values design, OCI registries, and real exposure to multiple Kubernetes distributions (OpenShift with SCCs, vanilla, RKE2, k0s, etc.).
- Hands-on experience in air-gapped or heavily restricted environments: image mirroring, offline bundles, egress proxies, custom CA bundles, no external DNS.
- Replaced managed cloud services with self-hosted equivalents (Postgres operators like CloudNativePG, MinIO or S3-compatible stores, Vault or External Secrets) and lived with operational consequences.
- Practical software supply chain security: image signing (cosign or equivalent), SBOM generation, distroless/minimal base images, CVE triage.
- Strong infrastructure-as-code and CI expertise (Terraform, Ansible, pipeline matrices).
- Hands-on experience serving models on GPU: vLLM, NVIDIA NIM, or TensorRT-LLM, including VRAM and concurrency sizing and NVIDIA GPU Operator/Container Toolkit.
- Strong Go and/or Python skills; you will modify application code, not just YAML.
- Architectural judgment and the appetite to say no; staff-level authority and willingness to use it.
- Fluent in French and English.
