Your area of work:
The launch D7 platform has been the starting point of Clearstream’s digital strategy, covering both domestic and international issuance markets. Following that success, we are continuing building the very first European Digital CSD by connecting our existing and traditional market infrastructure with our DLT tokenization platform, allowing to boost volumes, processing efficiency and to open up new business opportunities beyond the traditional CSD business, targeting the full value chain of digital and tokenized securities
About the Role:
As the DLT Infrastructure / DevOps Engineer, you will be in the core technicality for our blockchain operations within our DLT team, you will contribute in defining the macro-level infrastructure, deployment automation, and digital asset custody architecture.
You will be responsible for defining how our DLT nodes scale, how our environments are automated via modern CI/CD pipelines, and how our transaction-signing infrastructure securely integrates with high-security Hardware Security Modules (HSMs) and Multi-Party Computation (MPC) frameworks. You will work in close alignment with the DLT Solution Architect and the DLT Design Lead, translating high-level system designs into structured, resilient infrastructure components. You will clearly explain infrastructure requirements, security protocols, and operational workflows to the engineering team and continuously review deployment configurations to ensure compliance with enterprise-grade standards and industry best practices. Together with the DLT Design Lead, Product Managers, Security, and Compliance teams, in order to build a secure, highly resilient, production-grade DLT infrastructure.
Your responsibilities:
- DLT Infrastructure & Node Operations: Deploy, configure, monitor, and scale Hyperledger Besu nodes across dev, test, and production environments. Design resilient node topologies, peer discovery rules, and backup/restore strategies.
- HSM, MPC, & Wallet Integration: Implement, test, and maintain secure integrations between our Wallet-Service and enterprise Hardware Security Modules (HSMs) or MPC wallets.
- Cryptographic Key processing: Plan, document, and execute formal cryptographic key generation process for network operators, validators, and node identity keys.
- Security and Identity Management: Certificate lifecycle management, mTLS, TLS/SSL Certificate management, PKI And Truststore management, Kubernetes secret management, PKCS#11 integration.
- Blockchain Network Access Control & Security: Configure and manage permissioning and access control (on-chain and off-chain) for our Blockchain network (Hyperledger Besu).
- DevOps & Automation CI/CD: Write and maintain scripts (Terraform...), tekton pipelines, ArgoCD (GitOps) to automate node deployments and blockchain networks on Kubernetes/OpenShift and secure cloud platforms.
- Production Readiness & Performance: Set up monitoring, alerting, and logging (e.g., Dynatrace, Prometheus, Grafana…) to track node synchronization, consensus health, and HSM latency.
Your profile:
- University degree in Computer Science, IT, Cyber Security, or a related field (equivalent experience will be considered).
- 5+ years of experience in DevOps, System Engineering, or Infrastructure Engineering, with at least 2+ years of hands-on experience running blockchain/DLT nodes in production.
- Proven track record of managing cryptographic key storage systems, with deep hands-on expertise with institutional Hardware Security Modules (HSMs) and modern Multi-Party Computation (MPC) frameworks.
- Solid HSM & KMS Competency: Direct experience integrating application services with enterprise Hardware Security Modules and a strong understanding of PKCS#11 interfaces and asymmetric cryptography (ECDSA, secp256k1).
- Hyperledger Besu / EVM Expertise: Deep technical understanding of Hyperledger Besu (or similar Ethereum-based clients), including its consensus mechanisms (IBFT 2.0, QBFT), node synchronization modes, JSON-RPC APIs, and permissioning frameworks.
- Strong Container & Orchestration Skills: Hands-on experience with Docker, Kubernetes, or Red Hat OpenShift for deploying stateful workloads.
- Infrastructure-as-Code (IaC): Proficiency in automating cloud infrastructure using Terraform, or Helm.
- Security Mindset: Practical experience organizing or participating in high-security IT operational workflows, such as multi-signature schemes, key custodianship, and audit trails.
- Language Skills: Excellent written and spoken English.
- Highly analytical mindset with a proactive approach to operational security, identifying single-points-of-failure, and taking clear ownership of disaster recovery outcomes.
- Excellent communication and collaboration skills, capable of translating complex cryptographic or infrastructure concerns into clear risk frameworks for compliance, security, and development teams.
- Strong team player with a collaborative spirit, able to maintain operational excellence within a fast-moving DLT team in a highly regulated financial context.
- High degree of self-motivation and independence, eager to continuously adapt to evolving standards in digital asset security.
Would be an advantage:
- Kaleido Infrastructure & Hyperledger FireFly
- Familiarity with financial industry network infrastructure (secure private networks, firewalls, load balancing, proxy configurations).
- Experience operating within highly regulated institutional environments (complying with ISO 27001, SOC 2, or financial outsourcing guidelines).
- Knowledge of smart contract deployment pipelines and decentralized app (dApp) deployment workflows.
You can look forward to our benefit package:
- Hybrid Work and Flexible working hours
- Work from abroad - 12 days of remote work from EU countries per year
- Group Share Plan - discount on company shares
- Pension fund contribution - 3% of your gross salary (5% after 5 years with us)
- Health & Wellbeing - fully covered Multisport card, life & accident insurance, sick days and 100% salary contribution during sick leave (up to 56 days)
- 25 vacation days
- Mobility - fully covered public transport in Prague & free parking
- Flexible Benefit Account (Pluxee) - 1200 per month
- Free Access to E-Learning Platforms, Internal Development Programs, Mentoring & Learning Budget
