Software Engineer, Infrastructure
Keycard Labs2 hours ago
Remote, United States or Remote, CanadaStaff+
Responsibilities
- Own the BYOC product experience, including installation, upgrades, support, security reviews, and documentation.
- Define supported clouds, regions, Kubernetes versions, customer guardrails, compatibility limits, and deprecation policies.
- Build repeatable infrastructure-as-code, account bootstrap, networking, PrivateLink, and certificate patterns for hosted and customer cells.
- Deliver staged releases, approval gates, rollback, observability, runbooks, and audited break-glass operations across independently versioned cells.
- Build scoped-credential agents for pre-install checks, installations, failed-upgrade triage, and runbook drafting, with human approval for customer-account changes.
- Set cost, configuration, isolation, workload identity, PKI, and credential-scope guardrails in collaboration with customer cloud and security teams.
- Participate in engineering escalation and on-call support.
Requirements
- Experience building infrastructure as software with Pulumi, Terraform, or CDK and writing Go or TypeScript tooling around it.
- Production experience running Kubernetes and Helm.
- Deep AWS experience, especially IAM, permission boundaries, Organizations, SCPs, and VPC networking.
- Experience running and upgrading software in customer-controlled VPCs, on-premises environments, or regulated networks.
- Experience shipping versioned releases with customer upgrade schedules, support matrices, and planned deprecations.
- Ability to debug across application, networking, proxy, TLS, security-group, and certificate layers.
- Experience working directly with customer platform and security teams and making product-versus-customization trade-offs.
- Strong written communication, planning, asynchronous collaboration, and judgment about when to engage synchronously.
- Regular use of coding agents for infrastructure work and a clear understanding of where human review is required.
- Preferred: experience building BYOC, single-tenant, or self-hosted offerings at an infrastructure, data, or security company.
- Preferred: GCP or Azure experience alongside AWS, including private connectivity.
- Preferred: production experience with workload identity and PKI, including SPIFFE/SPIRE, cert-manager, or private CAs.
- Preferred: OAuth, OIDC, or mTLS experience and interest in agent protocols such as MCP.
Benefits
- Market-competitive salary and generous equity packages with a four-year vest and one-year cliff.
- Health, dental, vision, and paramedical coverage for the employee and family.
- Four weeks of vacation, 11 statutory holidays, and one volunteer day annually; the company encourages at least two weeks off each year for recharge.
- New MacBook Pro, $500 peripherals stipend, and access to AI tools.
- Remote-first work with asynchronous collaboration and hiring focused in North and South America.
- High autonomy, opportunities for mastery, and work on agent-native infrastructure.
Tech Stack
Categories
About Keycard Labs
Keycard is on a mission to redefine machine identity for the Internet—helping developers seamlessly connect people, agents, and services across networks, clouds, and applications. As AI-driven workflows grow more complex, Keycard’s dynamic, identity-based credentials ensure every agent and service operates with precise, contextual permissions. We’re building a global identity network backed by open protocols—empowering distributed systems to adapt, scale, and maintain cryptographically verifiable trust. By rethinking secret management from first principles, we aim to delight developers, meet the performance needs of platform engineers, and set a new standard for cloud-era security in an inclusive, collaborative environment.