Software Engineer (Python) — Programmable Networking

**About Telnyx** *Telnyx is an industry leader that's not just imagining the future of global connectivity—we're building it. From architecting and amplifying the reach of a* [*private, global, multi-cloud IP network*](https://telnyx.com/our-network)*, to bringing* [*hyperlocal edge*](https://telnyx.com/resources/about-edge-connectivity) *technology right to your fingertips through intuitive APIs, we're shaping a new era of seamless interconnection between people, devices, and applications.* *We're driven by a desire to transform and modernize what's antiquated, automate the manual, and solve real-world problems through innovative connectivity solutions. As a testament to our success, we're proud to stand as a financially stable and profitable company. Our robust profitability allows us not only to invest in pioneering technologies but also to foster an environment of continuous learning and growth for our team.* *Our collective vision is a world where borderless connectivity fuels limitless innovation. By joining us, you can be part of laying the foundations for this interconnected future. We're currently seeking passionate individuals who are excited about the opportunity to contribute to an industry-shaping company while growing their own skills and careers.* We're looking for a senior engineer who lives at the seam between software and the network — someone who's built customer-facing APIs where a `POST` doesn't end at a database row, it ends at a router being configured in a PoP. You're strong in async Python, comfortable in Go, and you can read an FRR or VyOS config as easily as an application stack trace. You've lived with the async-job, rollback, and eventual-consistency problems that come from programming real infrastructure through an API, and you're happy in a fast-paced environment where the thing you ship is visible and consequential. **The Opportunity** Telnyx sells networking as an API product: Private Networks, WireGuard interfaces, Virtual Cross Connects into AWS/Azure/GCP, anycast Global IP, and Public Internet Gateways. A small team owns this end-to-end — the public REST API, the orchestration control plane behind it, and the automation that programs real routers across our US, EU, and APAC PoPs. This role is the full stack of that. You design the API resource, write the orchestration code that turns a request into a network deployment, and own the BGP config it renders onto the fleet. You'll be part of a small, focused team where you own products from the developer-facing spec all the way down to the config on the box — and where the network layer isn't someone else's problem, it's the point. **What you'll own** - **The public API** on — `/networks`, `/virtual_cross_connects`, `/wireguard_interfaces`, `/wireguard_peers`, `/global_ips`, `/public_internet_gateways` and their coverage/health/usage endpoints. Resource modeling, OpenAPI 3 specs (public and private), edge API-gateway routing, and backward compatibility for live customers. - **The orchestration control plane** (Python 3.12, asyncio) — translating POST/DELETE into network deployments: resource allocation (IPAM, port/route-distinguisher/GRE-ID pools), Postgres-backed job queues (`SKIP LOCKED`), retries, rollback on partial failure, deploy/decommission runners, and long-running health-check and reconciliation daemons. - **The network automation layer** — Ansible + asyncssh/netmiko pushing Jinja2-templated config to a fleet of Linux and VyOS nodes: WireGuard interface and peer lifecycle, FRR/VyOS BGP (VRFs, route reflectors, BGP labels), GRE tunnels, static NAT and firewall rules, Unbound DNS, anycast announce/withdraw driven by health checks, and config-drift detection. - **Cloud interconnect integrations** — Equinix Fabric and Equinix Metal APIs to land virtual cross connects into AWS, Azure, and Google Cloud regions. - **Envoy-based data planes** — a Go xDS control plane on envoyproxy/go-control-plane, pushing CDS/RDS/EDS over ADS to edge and gateway Envoy fleets. - **Production** — Prometheus/Telegraf metrics and alerting, Bugsnag, customer escalations that span app logic and the network, and billing sync (MRC) for network resources. **Tech stack (what you'll actually touch)** - **Languages:** Python (asyncio: aiohttp, uvloop, SQLAlchemy, Alembic, aiopg), Go (Envoy control plane), Jinja2, Bash - **Data:** PostgreSQL (schema design, migrations, advisory locking, as a job queue), RabbitMQ - **Network OS / routing:** VyOS, FRR, Linux networking (VRFs, netfilter/NAT, netplan, GRE, WireGuard), BGP (VRFs, route reflectors, communities/labels, anycast), Unbound - **Automation:** Ansible / ansible-runner, netmiko, asyncssh, NetBox-style IPAM (pynetbox, netaddr) - **Proxy / data plane:** Envoy, xDS (ADS, go-control-plane) - **Vendor & cloud:** Equinix Fabric, Equinix Metal, AWS / Azure / GCP interconnect regions - **Platform:** Docker/OCI, GitHub Actions, HashiCorp Vault, OpenAPI 3 + Redocly, pytest (unit → e2e), mypy/ruff/black - **Architecture:** clean/hexagonal (usecases, repository interfaces, adapters) — the service is structured, not a script pile **Who we're looking for** - You've built and operated customer-facing REST APIs over real infrastructure — APIs where a POST ends in a router being configured, not just a row inserted — and you've lived with the async-job, rollback, and eventual-consistency problems that creates. - Strong async Python in production, and comfortable writing and reviewing Go. - Working routing knowledge: you can configure and debug BGP sessions, VRFs, GRE tunnels, NAT, and WireGuard, and read FRR or VyOS configs. Certification not required; hands-on ability is. - Postgres beyond ORM basics — migrations on live systems, locking semantics, queue patterns. - Fleet automation over SSH — Ansible at production scale, idempotent roles, safe rollout/rollback, drift detection. - You've debugged incidents across layers in one sitting — `tcpdump`, `wg show`, `vtysh`, and application logs — ending in either a code fix or a config fix, and knowing which. **Bonus points for** - Envoy/xDS control-plane work (go-control-plane, ADS snapshots). - Cloud interconnect products — AWS Direct Connect, Azure ExpressRoute, GCP Partner Interconnect, or Equinix Fabric/Metal provisioning APIs. - IPAM internals (NetBox or equivalent), address-plan and route-distinguisher design. - Linux → VyOS (or equivalent NOS) migration experience on live customer traffic. - Mobile core exposure — routing toward PGW/PCEF/EPC, GRE toward packet gateways. - OpenAPI spec authorship and public developer documentation. - Operating multi-site PoP fleets (bare metal + Equinix-hosted). **What this role is not** - **Not a NetOps/NOC role.** The deliverable is software — APIs, control planes, automation — not manual device changes. - **Not a pure backend CRUD role.** If the network layer in the stack above reads as someone else's problem, this is the wrong fit.