Senior Site Reliability Engineer

Thunderbird is one of the world’s most trusted open-source email applications, empowering more than 20 million people globally. At MZLA, the team behind Thunderbird, we build privacy-respecting communication tools that help people manage their digital lives while staying in control of their data.

We are open source by design. Our products are developed transparently and in collaboration with a global community of contributors, and that same spirit shapes how we work: collaboratively, inclusively, and with a shared commitment to putting users first.

Our small but growing distributed team includes 65+ people across seven countries. As Thunderbird evolves beyond a single desktop application, we are expanding across desktop, mobile, and paid services to build independent, privacy-respecting alternatives to big tech ecosystems.

Our revenue model combines user donations, which help keep Thunderbird’s apps freely available, with paid services that cover the costs of hosted offerings while supporting long-term sustainability and continued innovation.

• →Operate and evolve our EKS-based Kubernetes platform, supporting service migrations, platform improvements, and reliability initiatives.
• →Design and develop CI/CD systems supporting websites, services, and Thunderbird desktop releases, contributing to pipeline reliability and OIDC-based authentication across GitHub Actions workflows.
• →Write and maintain infrastructure in Pulumi and/or Terraform/OpenTofu across multiple AWS accounts.
• →Operate and evolve our observability stack (VictoriaMetrics, VictoriaLogs, Grafana, Vector) and partner with engineering teams to incorporate instrumentation and monitoring into service design.
• →Apply security-conscious infrastructure practices, including least-privilege IAM, secrets management via AWS Secrets Manager and External Secrets Operator, and network segmentation.
• →Diagnose and debug production incidents; drive root-cause analysis and post-incident improvements to prevent recurring problems.
• →Participate in on-call rotation and collaborate with SDEs and fellow SREs to ship, maintain, and monitor new builds and support service onboarding.
• →Contribute to runbooks, architecture documentation, and team processes.

• 7+ years of experience in infrastructure, platform engineering, or site reliability roles, including hands-on production Kubernetes experience in workload operations, troubleshooting, and cluster management.
• Hands-on experience with infrastructure-as-code on AWS using Terraform, OpenTofu, or Pulumi.
• Security awareness in day-to-day infrastructure work: identity, least privilege, secrets hygiene, and network controls.
• Demonstrated ownership mindset with the ability to proactively identify issues, drive work to completion, and communicate risks early.
• Excellent async written communication skills; comfortable working with a geographically distributed team. 
• Ability to collaborate effectively with software engineers and non-engineering stakeholders to improve platform reliability and operational efficiency.
• Ability to learn, evaluate, and responsibly use emerging technologies, including AI-enabled tools, to improve work processes.

• Experience with GitOps workflows (ArgoCD or Flux).
• Familiarity with Keycloak or similar identity platforms (OIDC, SAML, federation).
• Knowledge of email protocols and/or experience operating email infrastructure (SMTP, IMAP).
• Prior work in or alongside an open-source community.
• French, German, Japanese, or other language proficiency in addition to English.

You'll be successful in this role if you treat production as something to be understood, not just kept running. You write things down, flag problems before they become fires, and leave documentation better than you found it.

You bring production instincts. You've been paged at 2am, you know what good alerting looks like, and you've done the post-mortem work to make sure it doesn't happen the same way twice. You think in code, not in consoles. Your security awareness is baked in, not bolted on. You default to least privilege and ask "what's the blast radius?" before you ship.

You're comfortable with ambiguity. We're a small team building toward something, and you can make good decisions without a complete picture. Thunderbird is open-source software used by millions who choose privacy and ownership over convenience. That matters to you.

This is a full-time, fully remote position. You’ll join a distributed team of Thunderbird staff, open-source community members, and contributors from around the world.

We rely on clear communication, thoughtful documentation, and collaborative decision-making to work effectively across time zones and disciplines.

• Fully remote work & schedule flexibility
• Company-provided laptop
• Annual bonus program
• Monthly remote work stipend
• Annual professional development stipend
• Industry conferences
• Company all-hands and team gatherings

• 24 days PTO per year (prorated) 
• Your birthday
• Year-end company shutdown
• 9 wellbeing days 
• Public holidays
• Other paid leave
• Quarterly wellbeing stipend for personal / family activities

• 401(k) contributions
• Health, dental, & vision insurance
• Disability insurance
• Life insurance
• Employee assistance program 
• Paid parental leave
• Paid sick days 

Applicants must reside in and have permanent work authorization for the country location(s) specified in the posting. We are unable to consider applicants outside of these markets at this time. And, we do not provide visa sponsorship.

Please apply directly through our career page. We carefully review every cover letter and screening question, so take the time to answer each fully. We value authentic, thoughtful responses that reflect your own experience and perspective. It is fine to use AI tools to polish your writing, but your answers should be your own. Candidates who submit generic or unoriginal AI-generated responses may be disqualified from further consideration.

MZLA believes in the value of diverse creative practices and forms of knowledge, and knows diversity, equity and inclusion are crucial to and enrich the company’s core mission. We encourage applications from everyone, including members of all equity-seeking communities, such as (but not limited to) women, racialized and Indigenous persons, persons with disabilities, persons of all sexual orientations, gender identities and expressions.

We are an equal opportunity employer. We do not discriminate on the basis of race (including hairstyle and texture), religion (including religious grooming and dress practices), gender, gender identity, gender expression, color, national origin, pregnancy, ancestry, domestic partner status, disability, sexual orientation, age, genetic predisposition, medical condition, marital status, citizenship status, military or veteran status, or any other basis covered by applicable laws. MZLA will not tolerate discrimination or harassment based on any of these characteristics or any other unlawful behavior, conduct, or purpose. 

We will ensure that qualified individuals with disabilities are provided reasonable accommodations to participate in the job application or interview process, to perform essential job functions, and to receive other benefits and privileges of employment, as appropriate. Please contact us at hiringaccommodations@thunderbird.net to request accommodation.

#LI-DNI