Big Ideas. Real People.

At Orca, in the right environment and with the right team, talent has no boundaries. This team spirit, together with our drive to always aim high, has quickly earned us unicorn status and turned us into a global cloud security innovation leader. So if you’re ready to join an amazing team of people who inspire each other every day, now is the time to find your place in our pod. We’re looking for driven and talented people like you to join our R&D team and our mission to change the future of cloud security.

Ready to dive in and swim with our pod? 

Highlights:

• High-growth: Over the past seven years, we’ve consistently achieved milestones that take other companies a decade or more. During this time, we’ve significantly grown our employee base, expanded our customer reach, and rapidly advanced our product capabilities.
• Disruptive innovation: Our founders saw that traditional security didn’t work for the cloud, so they set out to carve a new path. We’re relentless pioneers who invented agentless technology and continue to be the most comprehensive and innovative cloud security company.
• Well-capitalized: With a valuation of $1.8 billion, Orca is a cybersecurity unicorn dominating the cloud security space. We’re backed by an impressive team of investors such as Capital G, ICONIQ, GGV, and SVCI, a syndicate of CISOs who invest their own money after conducting their due diligence.
• Respectful and transparent culture: Our executives pride themselves on being accessible to everyone and believe in sharing knowledge with the employees. Each employee has a place in shaping the future of our industry.

About the Role: 

• The Serving Layer team owns the data infrastructure behind Orca's platform UI and API. Every asset, alert, and query a customer sees is served from it, at high concurrency and with latency budgets measured in milliseconds. On the write side, the team ingests continuously from across the platform; on the read side, it serves the product.
• We're looking for a deeply hands-on engineer to own performance, data modeling, and operational reliability across that stack - someone who can move between a query execution plan, a Flink job's parallelism, and a Kubernetes operator upgrade in the same week.
• This is a senior individual-contributor role. You'll set technical direction for how our data is modeled, stored, and served, and you'll be the person others come to when something is slow and nobody knows why.

Our stack:

• Serving: SingleStore, self-managed on Kubernetes (operator-driven), plus Trino for analytical access
• Streaming and ingestion: Kafka / Amazon MSK, Apache Flink, Spark Structured Streaming, CDC pipelines
• Lakehouse: Apache Iceberg on S3, Parquet, custom compaction
• Infrastructure: AWS, EKS, Terraform, Helm, multi-region
• Languages: Python, Go, and a lot of SQL

What You'll Do:

• Own end-to-end query performance: plan analysis, shard-key and index design, statistics, join strategy, and driving down p99 latency under real concurrency
• Design and evolve the physical data models - sharding, partitioning, sort keys, retention - that serve product queries at scale, and the table layouts that make lakehouse reads fast
• Run SingleStore in production on Kubernetes: capacity and node topology, operator-driven upgrades and node refreshes, backup and restore, blast-radius and failure design
• Tune the ingestion path end to end: Kafka topic design and consumer performance, Flink and Spark job parallelism, checkpointing, backpressure, and data freshness
• Build the observability that catches performance regressions before customers do - query-level metrics, slow-query workflows, load-test harnesses
• Partner with product and platform teams on schema and query contracts, and push back on designs that won't hold at scale

What You Bring:

• 7+ years in backend, data, or infrastructure engineering, including 3+ years focused on distributed database or analytical query performance
• Real depth in database internals: reading and reshaping execution plans, understanding how sharding, partitioning, indexing, and join distribution drive latency, and diagnosing skew, spills, lock contention, and memory pressure in production
• Hands-on experience with a distributed OLAP/HTAP or MPP engine - SingleStore, ClickHouse, Druid, Pinot, Trino/Presto, Snowflake, Redshift, Vertica, or similar
• Strong data modeling judgment for read-heavy, latency-sensitive serving workloads, not only batch or warehouse modeling
• Production experience with distributed streaming- Kafka and at least one of Flink or Spark Structured Streaming - including performance and throughput tuning, not just wiring jobs together
• Working knowledge of a table format (Iceberg, Delta, Hudi) and what partitioning, file sizing, and compaction do to query performance
• Kubernetes fluency in production: operators and StatefulSets, resource management, persistent storage, safely upgrading stateful workloads
• Expert SQL, plus Python or Go
• Infrastructure-as-code and cloud operations (Terraform, Helm, AWS)
• Proven ownership of production systems: on-call, incident investigation, capacity planning

Bonus Points if You Have:

• Direct SingleStore experience, especially self-managed on Kubernetes
• Iceberg at scale: compaction strategy, metadata growth, maintenance jobs
• Multi-region, multi-tenant SaaS
• Experience introducing performance engineering practice to a team - benchmarks, regression gates, load testing as part of CI
• Cloud security or CNAPP domain background