> Markdown version of [/jobs/ext/2565131-forward-deployed-engineer](https://www.wearedevelopers.com/jobs/ext/2565131-forward-deployed-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Forward Deployed Engineer - **Company:** SMALLSTEP LABS, INC. - **Location:** United States (Remote available) - **Salary:** $185,000.0 - $230,000.0 - **Contract:** Permanent contract - **Skills:** Secure Shell (SSH), Microsoft Windows, Apple Mac Systems, User Authentication, Bash Shell, Chrome OS, Software Debugging, Linux, Github, Virtual Private Networks (VPN), Meter Data Management (Flow Meters), OAuth, Public Key Infrastructure, X.509, Cloud Services, Runbook, Software Construction, Wi-Fi Technology, Workspace ONE, Git, Microsoft InTune, Casper Suite, Gsuite, Terraform, Golang - **Published:** August 6, 2026 - **Apply:** https://www.indeed.com/viewjob?jk=f0485930af7ecdd3 ## About the Role * Debugging distributed, multi-service cloud architectures in live customer environments * Troubleshooting TLS/mTLS at the protocol level, including certificate chain validation, trust stores, and handshake failures * Production experience with certificate-based authentication, VPNs, enterprise Wi-Fi/EAP-TLS, RADIUS, SSH, OAuth * Developing and shipping production Golang code * Owning technical escalations directly with customers, in partnership with account teams Nice to Have * Familiarity with certificate enrollment protocols such as SCEP and ACME DA * PKI experience across macOS, Windows, Linux, and ChromeOS * Experience with hardware-backed security mechanisms such as Yubikeys, TPMs, HSMs, or secure enclaves * Experience carrying a formal on-call rotation with SLAs * Prior experience in a customer-facing technical role, such as a forward deployed engineer or solutions engineer Technologies * Golang, Bash, Terraform, Git, GitHub Actions * SCEP, ACME, SCIM, mTLS, EAP-TLS, RADIUS, PKI, X.509, SSH, TPMs * macOS, Windows, Linux, ChromeOS * MDMs (Jamf, Intune, Workspace One, Google Workspace Admin, Iru), Wi-Fi/RADIUS, VPNs We believe in action-based empathy. We actively work to create an environment where everyone feels welcome and valued as teammates and contributors. We know a diverse team is essential to create a vibrant and inclusive culture that fosters a true sense of belonging. By embracing the unique talents and perspectives of our entire team, we approach challenges in ways that a monocultural team simply cannot. ## Description We're looking for a Forward Deployed Engineer to embed with customers deploying Smallstep's device identity platform and get them to production. The most common use cases are securing Wi-Fi, browser mTLS, SSH, VPN and other network based communication using credentials issued by Smallstep's agent or an MDM. This role sits at the intersection of hardware, software, and the customer relationship: you'll move between a customer's endpoint fleet, their IdP, and Smallstep's own multi-service certificate authority services to get deployments unstuck., * Diagnosing and resolving technical failures blocking deployments * Acting as the technical escalation point for Technical Account Managers and Customer Success Engineers when a deployment needs deeper engineering involvement * Shipping production Golang code to resolve root causes uncovered during deployment debugging * Building proof-of-concept environments, using Bash and Terraform, and runbooks for new product surfaces ahead of polished UX * Setting day-to-day priorities and assignments for Smallstep's deployment ops engineers * Carrying a formal on-call rotation with defined SLAs * Capable of maintaining a high level of customer experience and a service mindset even in the face of implementation challenges. Building software at the edge isn't for the weak. * Growing the role over time into an even split between resolving live deployments, building reusable runbooks, and validating new use cases through proofs of concept ## Related Videos - [Docker network without Docker](https://www.wearedevelopers.com/videos/1418-docker-network-without-docker) - [How a Small Team Shrank a Microsoft Monorepo by 94%](https://www.wearedevelopers.com/videos/1236-how-a-small-team-shrank-a-microsoft-monorepo-by-94) - [Enabling automated 1-click customer deployments with built-in quality and security](https://www.wearedevelopers.com/videos/83-enabling-automated-1-click-customer-deployments-with-built-in-quality-and-security) - [Docker exec without Docker](https://www.wearedevelopers.com/videos/1094-docker-exec-without-docker) - [Git for Code Reviews](https://www.wearedevelopers.com/videos/429-git-for-code-reviews) - [The Developer Workstation Blind Spot: Why Your Security Stack Can't See What Matters Most](https://www.wearedevelopers.com/videos/100254-the-developer-workstation-blind-spot-why-your-security-stack-can-t-see-what-matters-most) ## Related Articles - [How We Built a Worry-Free System That Runs for 10+ Years – And What We’d Do Again](https://www.wearedevelopers.com/magazine/751-how-we-built-a-worry-free-system-that-runs-for-10-years-and-what-we-d-do-again) - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [Dev Digest 120 - Apple and peers](https://www.wearedevelopers.com/magazine/455-dev-digest-120-apple-and-peers) - [Dev Digest 138 - Are you secure about this?](https://www.wearedevelopers.com/magazine/486-dev-digest-138-are-you-secure-about-this) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [Dev Digest 121 - AI goes offline](https://www.wearedevelopers.com/magazine/456-dev-digest-121-ai-goes-offline)