Job description

BeyondTrust is a place where you can bring your purpose to life through the work that you do, creating a safer world through our cybersecurity SaaS portfolio. Our culture of flexibility, trust, and continual learning means you will be recognized for your growth, and for the impact you make on our success. You will be surrounded by people who challenge, support, and inspire you to be the best version of yourself. The Role The SRE Manager is the operating leader of a new cross-product SRE team at BeyondTrust, standing up and running the AWS GovCloud environments that bring additional BeyondTrust products into our FedRAMP authorization. Reporting to the VP of Application Engineering, this role owns the reliability, change control, and continuous-compliance machinery for those environments so that product feature teams can stay focused on product delivery. This is a player-coach role. The right person has staff-level technical depth: they can critically review Terraform, pipeline definitions, and architecture proposals, have personally built and operated this machinery, and can carry context in an incident. That depth is combined with real people-management experience: they have hired, grown, and run a small SRE or DevOps team, and they own the team's delivery, not just its architecture. The engineering execution sits with the team; the manager stays close enough to the keyboard to lead it credibly. The first-year mission is concrete: build and operate the AWS GovCloud environments that bring the covered products into our FedRAMP authorization, with the automation to keep them continuously compliant under FedRAMP 20x, where evidence is machine-readable, re-verified every few days, and reported monthly. Our feature teams own product delivery. This role exists so they can focus on it. The SRE Manager takes permanent ownership of the shared operational work that would otherwise fall on feature teams as toil: the GovCloud environments, production operations, release and update machinery, and the compliance evidence pipeline for the covered products. The team this role leads is an engineering team that owns operations, not an operations team. Its product is automation; operations is the input. Every manual procedure performed twice is a candidate for elimination, and the team's success is measured by the operational work it has made unnecessary, not the tickets it has closed. Hands-on operational work is capped at roughly half of team capacity; the rest goes to engineering the work away. Defending that split against day-to-day pressure is the manager's job. What You’ll Do GovCloud build and FedRAMP delivery Own the AWS GovCloud landing zone for the new product environments: multi-account structure, SCPs and guardrails, logging and security-tooling accounts, IaC-native provisioning Own the continuous-compliance evidence pipeline: collection, normalization, and reporting of FedRAMP 20x Key Security Indicators, built to the FedRAMP standard schema Own FedRAMP continuous monitoring obligations for the covered environments, keeping that operational load off feature team engineers; broader compliance obligation tracking and audit coordination are owned by central teams Own the CI/CD pipelines the GovCloud environments require (build, signing, artifact management, quality and security gates) and cloud cost visibility for the covered accounts Production and change operations Own the production change process, including change request governance, access controls, and approval standards, with auditable separation of duties between development and production Own release and update machinery for cloud fleets: mandatory security updates, staged and jittered rollout windows, cluster-coordinated installs, and verification that a patch actually landed everywhere it was scoped to Own the incident management process, tooling, on-call design, and post-incident review cadence Drive the automated environment promotion path from development through staging to production Note on workload shape: our estates are appliance-model and single-tenant VM fleets alongside shared services, not purely cloud-native. Fleet upgrade orchestration, golden images, and staged rollout at hundreds-to-thousands scale are core, not edge cases. Intake and prioritization Run intake and prioritization for operational requests from feature teams and leadership, keeping a single trusted view of active work, owners, and risks Ensure the team is not overcommitted and that feature teams have a clear, responsive interface for operational needs Team leadership Lead a team of DevOps, SRE, and security automation engineers, providing direction, accountability, and operational clarity Partner with the VP of Application Engineering on workforce planning, hiring, role design, and onboarding for the function Build a culture of ownership, transparency, and reliable execution; set delivery rhythms, run planning cycles, and maintain visibility into team capacity and health What Success Looks Like The covered products live in AWS GovCloud under the FedRAMP authorization, with evidence produced by automation rather than by hand Production changes go through a defined, auditable process; uncontrolled changes do not reach production Patches and releases are verified as landed everywhere they were scoped to, as a system property rather than a manual check FedRAMP continuous monitoring obligations are met on time, every month, without feature teams being interrupted or senior engineers pulled from product work Better Together Diversity. Inclusion. They’re more than just words for us. They are the guiding values of how we build our teams, cultivate leaders, and create a culture where people feel connected. We take care of our employees so they can take care of our customers. Customers who come from all walks of life just like us. We hire incredible people from diverse backgrounds because when we are different together, we are stronger together. About Us BeyondTrust is the global identity security leader protecting Paths to Privilege™. Our identity-centric approach goes beyond securing privileges and access, empowering organizations with the most effective solution to manage the entire identity attack surface and neutralize threats, whether from external attacks or insiders. BeyondTrust is leading the charge in transforming identity security to prevent breaches and limit the blast radius of attacks, while creating a superior customer experience and operational efficiencies. We are trusted by 20,000 customers, including 75 of the Fortune 100, and our global ecosystem of partners. Learn more at www.beyondtrust.com . #LI-BS1

Requirements

Must-haves

BeyondTrust is a place where you can bring your purpose to life through the work that you do, creating a safer world through our cybersecurity SaaS portfolio.
What You’ll Do
GovCloud build and FedRAMP delivery
Own the AWS GovCloud landing zone for the new product environments: multi-account structure, SCPs and guardrails, logging and security-tooling accounts, IaC-native provisioning
Own the continuous-compliance evidence pipeline: collection, normalization, and reporting of FedRAMP 20x Key Security Indicators, built to the FedRAMP standard schema
Own the CI/CD pipelines the GovCloud environments require (build, signing, artifact management, quality and security gates) and cloud cost visibility for the covered accounts
Production and change operations
Own the production change process, including change request governance, access controls, and approval standards, with auditable separation of duties between development and production
Own release and update machinery for cloud fleets: mandatory security updates, staged and jittered rollout windows, cluster-coordinated installs, and verification that a patch actually landed everywhere it was scoped to
Own the incident management process, tooling, on-call design, and post-incident review cadence
Drive the automated environment promotion path from development through staging to production
Intake and prioritization
Run intake and prioritization for operational requests from feature teams and leadership, keeping a single trusted view of active work, owners, and risks
Ensure the team is not overcommitted and that feature teams have a clear, responsive interface for operational needs
Team leadership
Lead a team of DevOps, SRE, and security automation engineers, providing direction, accountability, and operational clarity
Partner with the VP of Application Engineering on workforce planning, hiring, role design, and onboarding for the function
Build a culture of ownership, transparency, and reliable execution; set delivery rhythms, run planning cycles, and maintain visibility into team capacity and health
What Success Looks Like
The covered products live in AWS GovCloud under the FedRAMP authorization, with evidence produced by automation rather than by hand
Production changes go through a defined, auditable process; uncontrolled changes do not reach production
Patches and releases are verified as landed everywhere they were scoped to, as a system property rather than a manual check
FedRAMP continuous monitoring obligations are met on time, every month, without feature teams being interrupted or senior engineers pulled from product work
Better Together

Nice-to-haves

None flagged.

Application prep

Use the role’s language and application details while tailoring your materials.

Keywords to mirror

awsrestci/cdgo

Platform: greenhouse
Effort: quick

Benefits

Benefits detected in the listing.

Vision