Designs, secures, and operates on-premises infrastructure across Linux, VMware, Docker, networks, firewalls, and CI/CD pipelines. Owns FortiGate-based network security, secrets and PKI, vulnerability remediation, observability, incident response, compliance evidence, and disaster recovery support. The role also drives infrastructure-as-code, security automation, AI-augmented engineering workflows, documentation, and mentoring.
About KWI
KWI builds the unified commerce platform that powers some of the world's most recognized specialty and luxury retail brands. Behind every transaction, every clienteling interaction, and every store opening is an infrastructure team that keeps the lights on and is continuously raising the bar on how modern, and how secure, that platform runs. This is a role on that team.
The opportunity
If innovation lives in your DNA and AI is already part of how you think, build, and operate, you're going to love what we're doing at KWI. You'll join a small, senior team with a real mandate to design, build, secure, and run the systems that power retail at scale. This is hands-on, on-prem infrastructure work: our own hypervisors, our own network edge, our own containers, and our own pipelines. We move fast, we automate aggressively, and we expect security to be built into the platform rather than bolted onto it. Your fingerprints will be on the platform every day.
The impact you'll make
- Design, harden, and operate our on-prem footprint: VMware vSphere clusters, Linux virtual machines, and Docker workloads running across multiple datacenters and serving retail clients 24x7.
- Own the network edge. FortiGate policy design, NAT and VIPs, IPsec site-to-site and remote-access VPN, segmentation, IPS and UTM profiles, and disciplined change control on every rule you touch.
- Build security into the delivery pipeline. Container image and dependency scanning, SAST, secrets detection, IaC policy checks, signed artifacts, and vulnerability findings you drive to closure instead of to a spreadsheet.
- Containerize and template services with Docker and infrastructure-as-code so deployments are repeatable, declarative, and boring.
- Run the secrets and PKI plane: centralized secrets management, an internal certificate authority, automated certificate issuance and rotation, and a standing campaign to get hardcoded credentials out of the environment.
- Own incidents end to end: triage alerts, drive root-cause analysis across the application, network, database, and hypervisor layers, and write the post-incident docs that stop recurrence.
- Improve observability across the fleet. Metrics, logs, traces, dashboards, and firewall and flow telemetry, so problems are seen before customers feel them.
- Support audit, compliance, and penetration-test work: evidence collection, remediation SLAs, access reviews, and hardening baselines that hold up under scrutiny.
- Use modern AI-augmented engineering tools (Claude Code, MCP-based workflows, agentic automation) as a daily multiplier, to operate faster and extend what one engineer can deliver.
- Document and mentor. Runbooks, network diagrams, and design docs aren't an afterthought here. They're how the team scales.
What you will bring
Required
- 5+ years operating production Linux/UNIX (RHEL, CentOS/Rocky, Debian/Ubuntu) in an on-prem or hybrid environment at meaningful scale.
- Hands-on enterprise firewall experience, ideally FortiGate/FortiOS: policy design, NAT and VIPs, IPsec and SSL VPN, routing, HA pairs, and the judgment to change a live rule set safely. Deep Palo Alto or Cisco ASA/Firepower experience plus a genuine willingness to go deep on Fortinet also works.
- Strong networking fundamentals: TCP/IP, VLANs and segmentation, routing, DNS, TLS, HTTP/S, and load balancing. You can read a packet capture and a certificate chain and say what is actually happening.
- Production VMware vSphere experience: clusters and hosts, datastores, resource contention, snapshots and templates, and patching without an outage.
- Docker in production: image builds and hardening, registries, compose-based or orchestrated deployment, container networking, and troubleshooting the container that will not stay up.
- Practical DevSecOps: CI/CD pipelines with security gates, vulnerability management and CVE remediation at fleet scale, secrets management, and image scanning.
- Solid DevOps fundamentals: Git, CI/CD pipelines, Ansible (or similar configuration management), Terraform/OpenTofu (or similar IaC), and Docker.
- Comfortable scripting in Bash. Python is not required, but you should have a working understanding of programming fundamentals and be able to read, modify, and write straightforward code.
- Strong troubleshooting instincts and the temperament to lead under pressure.
Key skills (we'll weigh heavily)
- Real day-to-day experience using AI-augmented engineering tools (Claude, Cursor, Copilot, MCP servers, agentic workflows), not just demos.
- Firewall and network security operations at the edge of a production e-commerce platform: rule hygiene, attack-surface reduction, and closing external pen-test findings.
- Experience with a centralized secrets manager (HashiCorp Vault, OpenBao, or comparable) and internal PKI or certificate automation.
- Experience with Datadog, Grafana, or comparable observability platforms.
Nice to have
- Security certifications such as Fortinet NSE 4 or higher, Security+, CISSP, or OSCP, or equivalent demonstrated depth.
- Exposure to compliance frameworks that touch retail (PCI DSS, SOC 2) and the evidence work that comes with them.
- MySQL operational experience: replication, performance tuning, backups, and recovery.
- Load balancer experience (Kemp/LoadMaster, F5, HAProxy, NGINX), including SSL offload and WAF policy.
- Multi-datacenter, disaster-recovery, or failover-testing experience.
- Retail, e-commerce, or POS-adjacent operational experience.
As a member of the KWI team you will receive
- Full Medical, Dental and Vision
- Annual bonus eligible
- Free gym in the building
- Generous PTO policy
- Summer Fridays....all year round
- Tuition Reimbursement
- Discount from building café
- 401(K) with a 50% company match (up to 6% of employee contribution)
- Employee Referral Program
- (1) Volunteer day each year
Our work space
We understand that our teams need flexibility, which is why we follow a hybrid schedule. Our in-office days of Monday, Tuesday and Thursday, and employees are allowed to work remotely on Wednesdays and Friday.
We are also a collaborative group and believe that getting together in person allows our team to do their best work. Together we enjoy monthly events, bagels every Thursday, a state-of-the-art coffee machine, a full snack pantry and many more surprise and delight moments throughout the year.
Our commitment to you
At KWI, we know that cultivating diversity and fostering an inclusive work environment is critical to our impact and success. We create an environment where no individual is advantaged or disadvantaged because of their background. We offer equal opportunity employment regardless of race, color, religion, gender, gender identity or expression, sexual orientation, national origin, genetics, disability status, age, marital status, or protected veteran status.
With a commitment to maintaining a bias-free environment in which harassment is prohibited, we respect cultural diversity and comply with the laws of the places in which we operate. We expect our business partners, suppliers, clients, and all our team members to uphold these commitments.
About
KWI helps retailers maximize sales by uniting their online and in-store capabilities to deliver delightful shopper experiences. With KWI Merchandising and mobile POS, retailers can execute omnichannel flawlessly, and right at their fingertips — clienteling, endless aisle, mobile checkout with the latest payment options, inventory management, and ecommerce.
Similar Jobs
Information Technology
Owns the strategy, roadmap, backlog, and delivery of professional services products. Partners with technical and business stakeholders to define product vision, prioritize features, manage Agile release planning, track KPIs, conduct research, and communicate product direction to senior leaders. The role requires strong analytical, presentation, negotiation, and cross-functional collaboration skills, plus experience with professional or managed services and Agile methodologies.
Top Skills:
AgileCertinia PsaKanbanLucidchartMS OfficePowerPointSafeSalesforce CpqSalesforce CRMScrum
Information Technology
Leads strategic technology consulting engagements and advises clients on transformation, risk, and business objectives. Defines and governs enterprise integration architectures across ServiceNow and business systems, using APIs, workflows, data architecture, and security controls. Develops recommendations, roadmaps, executive presentations, and architectural standards; manages stakeholders, project governance, business development, and client relationships. Mentors consultants and designs secure, scalable, maintainable integration solutions across ServiceNow modules and enterprise technologies.
Top Skills:
AIAnsibleAPIsArtifactoryCommvaultCyberarkData ArchitectureDigicertGithub Ci/CdHashicorp VaultKubernetesPanoramaSecurity ControlsServicenowWorkflow OrchestrationXsoar
Artificial Intelligence • Healthtech • Machine Learning • Natural Language Processing • Real Estate
Own EliseAI’s customer-facing help center, internal knowledge hub, and knowledge-management strategy. Develop roadmaps, improve content accuracy and findability, establish quality and adoption standards, and create scalable workflows for capturing expertise from cross-functional teams. Use AI tools to prototype prompts and workflows, while partnering with Product, Engineering, Support, Solutions, and Implementation to maintain reliable, accessible knowledge systems.
Top Skills:
Claude CodeCursorLarge Language Models (Llms)Retrieval-Augmented Generation (Rag)
What you need to know about the NYC Tech Scene
As the undisputed financial capital of the world, New York City is an epicenter of startup funding activity. The city has a thriving fintech scene and is a major player in verticals ranging from AI to biotech, cybersecurity and digital media. It also has universities like NYU, Columbia and Cornell Tech attracting students and researchers from across the globe, providing the ecosystem with a constant influx of world-class talent. And its East Coast location and three international airports make it a perfect spot for European companies establishing a foothold in the United States.
Key Facts About NYC Tech
- Number of Tech Workers: 549,200; 6% of overall workforce (2024 CompTIA survey)
- Major Tech Employers: Capgemini, Bloomberg, IBM, Spotify
- Key Industries: Artificial intelligence, Fintech
- Funding Landscape: $25.5 billion in venture capital funding in 2024 (Pitchbook)
- Notable Investors: Greycroft, Thrive Capital, Union Square Ventures, FirstMark Capital, Tiger Global Management, Tribeca Venture Partners, Insight Partners, Two Sigma Ventures
- Research Centers and Universities: Columbia University, New York University, Fordham University, CUNY, AI Now Institute, Flatiron Institute, C.N. Yang Institute for Theoretical Physics, NASA Space Radiation Laboratory
