Software Engineer (Python) — Programmable Networking

We're looking for a senior engineer who lives at the seam between software and the network — someone who's built customer-facing APIs where a POST doesn't end at a database row, it ends at a router being configured in a PoP. You're strong in async Python, comfortable in Go, and you can read an FRR or VyOS config as easily as an application stack trace. You've lived with the async-job, rollback, and eventual-consistency problems that come from programming real infrastructure through an API, and you're happy in a fast-paced environment where the thing you ship is visible and consequential.

The Opportunity

Telnyx sells networking as an API product: Private Networks, WireGuard interfaces, Virtual Cross Connects into AWS/Azure/GCP, anycast Global IP, and Public Internet Gateways. A small team owns this end-to-end — the public REST API, the orchestration control plane behind it, and the automation that programs real routers across our US, EU, and APAC PoPs.

This role is the full stack of that. You design the API resource, write the orchestration code that turns a request into a network deployment, and own the BGP config it renders onto the fleet. You'll be part of a small, focused team where you own products from the developer-facing spec all the way down to the config on the box — and where the network layer isn't someone else's problem, it's the point.

What you'll own

• The public API on api.telnyx.com — /networks, /virtual_cross_connects, /wireguard_interfaces, /wireguard_peers, /global_ips, /public_internet_gateways and their coverage/health/usage endpoints. Resource modeling, OpenAPI 3 specs (public and private), edge API-gateway routing, and backward compatibility for live customers.
• The orchestration control plane (Python 3.12, asyncio) — translating POST/DELETE into network deployments: resource allocation (IPAM, port/route-distinguisher/GRE-ID pools), Postgres-backed job queues (SKIP LOCKED), retries, rollback on partial failure, deploy/decommission runners, and long-running health-check and reconciliation daemons.
• The network automation layer — Ansible + asyncssh/netmiko pushing Jinja2-templated config to a fleet of Linux and VyOS nodes: WireGuard interface and peer lifecycle, FRR/VyOS BGP (VRFs, route reflectors, BGP labels), GRE tunnels, static NAT and firewall rules, Unbound DNS, anycast announce/withdraw driven by health checks, and config-drift detection.
• Cloud interconnect integrations — Equinix Fabric and Equinix Metal APIs to land virtual cross connects into AWS, Azure, and Google Cloud regions.
• Envoy-based data planes — a Go xDS control plane on envoyproxy/go-control-plane, pushing CDS/RDS/EDS over ADS to edge and gateway Envoy fleets.
• Production — Prometheus/Telegraf metrics and alerting, Bugsnag, customer escalations that span app logic and the network, and billing sync (MRC) for network resources.

Tech stack (what you'll actually touch)

• Languages: Python (asyncio: aiohttp, uvloop, SQLAlchemy, Alembic, aiopg), Go (Envoy control plane), Jinja2, Bash
• Data: PostgreSQL (schema design, migrations, advisory locking, as a job queue), RabbitMQ
• Network OS / routing: VyOS, FRR, Linux networking (VRFs, netfilter/NAT, netplan, GRE, WireGuard), BGP (VRFs, route reflectors, communities/labels, anycast), Unbound
• Automation: Ansible / ansible-runner, netmiko, asyncssh, NetBox-style IPAM (pynetbox, netaddr)
• Proxy / data plane: Envoy, xDS (ADS, go-control-plane)
• Vendor & cloud: Equinix Fabric, Equinix Metal, AWS / Azure / GCP interconnect regions
• Platform: Docker/OCI, GitHub Actions, HashiCorp Vault, OpenAPI 3 + Redocly, pytest (unit → e2e), mypy/ruff/black
• Architecture: clean/hexagonal (usecases, repository interfaces, adapters) — the service is structured, not a script pile

Who we're looking for

• You've built and operated customer-facing REST APIs over real infrastructure — APIs where a POST ends in a router being configured, not just a row inserted — and you've lived with the async-job, rollback, and eventual-consistency problems that creates.
• Strong async Python in production, and comfortable writing and reviewing Go.
• Working routing knowledge: you can configure and debug BGP sessions, VRFs, GRE tunnels, NAT, and WireGuard, and read FRR or VyOS configs. Certification not required; hands-on ability is.
• Postgres beyond ORM basics — migrations on live systems, locking semantics, queue patterns.
• Fleet automation over SSH — Ansible at production scale, idempotent roles, safe rollout/rollback, drift detection.
• You've debugged incidents across layers in one sitting — tcpdump, wg show, vtysh, and application logs — ending in either a code fix or a config fix, and knowing which.

Bonus points for

• Envoy/xDS control-plane work (go-control-plane, ADS snapshots).
• Cloud interconnect products — AWS Direct Connect, Azure ExpressRoute, GCP Partner Interconnect, or Equinix Fabric/Metal provisioning APIs.
• IPAM internals (NetBox or equivalent), address-plan and route-distinguisher design.
• Linux → VyOS (or equivalent NOS) migration experience on live customer traffic.
• Mobile core exposure — routing toward PGW/PCEF/EPC, GRE toward packet gateways.
• OpenAPI spec authorship and public developer documentation.
• Operating multi-site PoP fleets (bare metal + Equinix-hosted).

What this role is not

• Not a NetOps/NOC role. The deliverable is software — APIs, control planes, automation — not manual device changes.
• Not a pure backend CRUD role. If the network layer in the stack above reads as someone else's problem, this is the wrong fit.