Software Engineer III - Linux & AWS

at Arcesiumllc

Hyderabad, senior, full time, 5–8 years

posted 17 Sept 2026

Apply for this role Sign in to track your application

Unix
AWS WorkSpaces
systemd
apt
strace
journalctl
Homebrew
VPC
SSH
Active Directory
WSL
Kerberos
GSSAPI
STS
Linux
KCM
IAM
CloudWatch
Ansible
Nix
AWS
PAM
dnf

About the role

Posted: 2026-09-17

What you would do

- Resolve fleet-wide health issues at the root: Investigate unhealthy/stuck/disconnecting WorkSpaces reported daily by end users — stale desktop-session state, broken shell config after a distro migration, disk/memory exhaustion, CloudWatch-reported anomalies — and fix the underlying cause via Ansible rather than a one-off reboot.

- Own Ansible for the Linux/WorkSpaces fleet: Author and review playbooks and roles covering package management, DNS/nameserver config, credential-refresh scripts, PAM/Kerberos, and systemd-based job scheduling; land changes through a peer-reviewed merge-request workflow with staged rollout and a rollback plan.

- Troubleshoot auth and identity plumbing: Debug Kerberos/KCM cache issues, kinit failures, GSSAPI/publickey SSH auth errors, and STS regional-endpoint assumptions across accounts — the kind of problems that show up as "VSCode SSH won't connect" but trace back to credential caches or IAM endpoint config.

- Keep package management and toolchains working: Own issues across modern and traditional Linux package managers and internal package repositories — SSL/cert trust issues, GPG signature failures, repository-trust enforcement changes — so day-to-day package installs keep working across every supported distro and macOS/WSL.

- Support new region and OS rollouts: Help stand up new WorkSpaces regions and new OS bundles (e.g. newer Ubuntu/Rocky Linux releases) — directory setup, bundle config, lifecycle automation, and portal integration — and lead migration paths off end-of-life images.

- Build observability, not just fixes: Extend monitoring for Ansible run failures and workspace health so issues surface as alerts before they become a wave of support requests; contribute to diagnostic tooling that lets users self-service common problems.

- Debug container and dev-tool issues on the fleet: Resolve container networking-at-boot failures, credential-in-container breakage, dev container support, and IDE/SSH integration issues that block engineers mid-task.

- Set the platform standard and mentor: Define how root-cause fixes get codified into Ansible and documentation rather than repeated as generic advice; raise the technical bar of the wider team and be the reference point for how hard Unix problems get diagnosed and closed out permanently.

Read from job-boards.greenhouse.io, last seen 3d ago.

What they are looking for

- Experience: 5–8+ years in Linux systems engineering, with real ownership of production Linux fleets — not just following documented procedures.

- AWS WorkSpaces / VDI depth: Hands-on experience operating and troubleshooting AWS WorkSpaces (or equivalent Linux VDI) — directory integration, bundle/image lifecycle, region rollouts, connectivity and performance diagnosis (WSP protocol, CloudWatch metrics).

- Advanced Unix/Linux fundamentals: Comfortable reasoning about systemd, PAM, Kerberos/KCM credential caches, SSH auth mechanisms (publickey, GSSAPI), filesystem/permission issues, and using strace/journalctl/perf to get from symptom to root cause - not just restarting the service.

- Ansible in production: Strong hands-on Ansible — playbooks, roles, idempotency, staged rollout — and comfort working through a peer-reviewed merge-request workflow with CI as the primary way changes reach the fleet.

- Package ecosystem knowledge: Familiarity with Linux package managers across distros (apt/dnf), Homebrew, and modern declarative package/environment managers (e.g. Nix-based tooling) — including the cert-trust, GPG-signing, and repo-config issues that come with managing them at fleet scale.

- R&D mindset: A track record of independently digging into unfamiliar problems (e.g. AWS/Rocky Linux bug backports, kernel-level networking issues) rather than waiting for someone else to hand you a fix.

- Cloud & directory services foundation: Solid AWS fundamentals (IAM, STS, VPC networking) and enough Active Directory/Kerberos literacy to debug identity issues that span the two.

- Communication under pressure: Able to work a live escalation with a blocked engineer without guessing — diagnose, explain, and close the loop; comfortable being the person others turn to when first-line steps don't work.

- Education: Bachelor's in Computer Science, Engineering, or related field; equivalent hands-on experience considered.

Arcesium's Personal Data Privacy Notice for Candidates is linked here.

Recruiting Security Emails from genuine Arcesium recruiters who are employees of the company will always come from the @arcesium.com domain. In some cases, you may also be contacted by independent search firms engaged to recruit on our behalf; emails from their employees should always come from their firm's applicable domain. We'll never ask for your banking information or any payment as part of the recruiting process. If something seems off or you're contacted by an unexpected third party, please reach out to us at careers@arcesium.com (US/UK), careers-india@arcesium.com (India) or careers-europe@arcesium.com (Portugal/Sweden).

Arcesium is an equal opportunity employer.