Software Engineer III Linux & AWS

Financial technology is a high-growth industry as change and innovation continue to disrupt the status-quo and prompt major transformation. Arcesium is at a particularly interesting time in our own growth as we look to leverage our successfully established market position and expand operations in pursuit of strategic new business opportunities. We value intellectual curiosity proactive ownership and collaboration with colleagues and we empower you to meaningfully contribute from day one and accelerate your professional development.

We are looking for someone who will own the architecture and health of the Linux side of Developer Compute the fleet of AWS WorkSpaces WSL and Linux config that thousands of engineers build on every day. Youll set the standard for how the team ships Ansible changes through peer review do the deep OS-internals work that keeps the fleet healthy and act as the final technical authority when a problem survives first-line and self-service troubleshooting. This is a hands-on senior Unix engineering role: you diagnose from strace and journalctl design the fix at the platform level and make sure its codified so the same problem doesnt recur across the fleet.

The Role at a Glance

• Architect and own the Linux compute platform the design decisions behind AWS WorkSpaces WSL and the broader Linux fleet that thousands of engineers build on daily.
• Set the automation standard: define how configuration patching and lifecycle management are codified in Ansible and enforced through engineering review not just author individual changes.
• Act as the final technical authority on hard Unix/identity/infrastructure problems the ones that survive first-line and self-service troubleshooting.
• Drive the platforms technical roadmap: OS/region expansion deprecation of legacy images and R&D into Unix-ecosystem capabilities the fleet doesnt yet have.

What Youll Do:

• Resolve fleet-wide health issues at the root: Investigate unhealthy/stuck/disconnecting WorkSpaces reported daily by end users stale desktop-session state broken shell config after a distro migration disk/memory exhaustion CloudWatch-reported anomalies and fix the underlying cause via Ansible rather than a one-off reboot.
• Own Ansible for the Linux/WorkSpaces fleet: Author and review playbooks and roles covering package management DNS/nameserver config credential-refresh scripts PAM/Kerberos and systemd-based job scheduling; land changes through a peer-reviewed merge-request workflow with staged rollout and a rollback plan.
• Troubleshoot auth and identity plumbing: Debug Kerberos/KCM cache issues kinit failures GSSAPI/publickey SSH auth errors and STS regional-endpoint assumptions across accounts the kind of problems that show up as VSCode SSH wont connect but trace back to credential caches or IAM endpoint config.
• Keep package management and toolchains working: Own issues across modern and traditional Linux package managers and internal package repositories SSL/cert trust issues GPG signature failures repository-trust enforcement changes so day-to-day package installs keep working across every supported distro and macOS/WSL.
• Support new region and OS rollouts: Help stand up new WorkSpaces regions and new OS bundles (e.g. newer Ubuntu/Rocky Linux releases) directory setup bundle config lifecycle automation and portal integration and lead migration paths off end-of-life images.
• Build observability not just fixes: Extend monitoring for Ansible run failures and workspace health so issues surface as alerts before they become a wave of support requests; contribute to diagnostic tooling that lets users self-service common problems.
• Debug container and dev-tool issues on the fleet: Resolve container networking-at-boot failures credential-in-container breakage dev container support and IDE/SSH integration issues that block engineers mid-task.
• Set the platform standard and mentor: Define how root-cause fixes get codified into Ansible and documentation rather than repeated as generic advice; raise the technical bar of the wider team and be the reference point for how hard Unix problems get diagnosed and closed out permanently.

What Youll Need:

• Experience: 58 years in Linux systems engineering with real ownership of production Linux fleets not just following documented procedures.
• AWS WorkSpaces / VDI depth: Hands-on experience operating and troubleshooting AWS WorkSpaces (or equivalent Linux VDI) directory integration bundle/image lifecycle region rollouts connectivity and performance diagnosis (WSP protocol CloudWatch metrics).
• Advanced Unix/Linux fundamentals: Comfortable reasoning about systemd PAM Kerberos/KCM credential caches SSH auth mechanisms (publickey GSSAPI) filesystem/permission issues and using strace/journalctl/perf to get from symptom to root cause - not just restarting the service.
• Ansible in production: Strong hands-on Ansible playbooks roles idempotency staged rollout and comfort working through a peer-reviewed merge-request workflow with CI as the primary way changes reach the fleet.
• Package ecosystem knowledge: Familiarity with Linux package managers across distros (apt/dnf) Homebrew and modern declarative package/environment managers (e.g. Nix-based tooling) including the cert-trust GPG-signing and repo-config issues that come with managing them at fleet scale.
• R&D mindset: A track record of independently digging into unfamiliar problems (e.g. AWS/Rocky Linux bug backports kernel-level networking issues) rather than waiting for someone else to hand you a fix.
• Cloud & directory services foundation: Solid AWS fundamentals (IAM STS VPC networking) and enough Active Directory/Kerberos literacy to debug identity issues that span the two.
• Communication under pressure: Able to work a live escalation with a blocked engineer without guessing diagnose explain and close the loop; comfortable being the person others turn to when first-line steps dont work.
• Education: Bachelors in Computer Science Engineering or related field; equivalent hands-on experience considered.

Arcesiums Personal Data Privacy Notice for Candidates is linkedhere.

Recruiting Security
Emails from genuine Arcesium recruiters who are employees of the company will always come from some cases you may also be contacted by independent search firms engaged to recruit on our behalf; emails from their employees should always come from their firms applicable domain. Well never ask for your banking information or any payment as part of the recruiting process. If something seems off or youre contacted by an unexpected third party please reach out to us at (US/UK) (India) or (Portugal/Sweden).

Arcesium is an equal opportunity employer.