Software Engineer, Infrastructure

The role

You will own the build, release, and deployment systems for Keycard's multi-tenant cloud and Bring-your-own-cloud (BYOC) product. You will build delivery and operating tools using AWS, EKS, Pulumi, and Helm to ensure reliability, security, and cost-efficiency.

What you will do

• Own the BYOC product including installation, upgrades, and customer support.
• Decide supported clouds, regions, Kubernetes versions, and customer guardrails.
• Manage deployments via infrastructure as code, account bootstrap, and network patterns.
• Own release pipelines from commit to running deployment with staged promotion and rollback.
• Set availability and durability targets for the hosted service with observability and runbooks.
• Operate customer-hosted deployments using audited break-glass.
• Build agents for repetitive work like pre-install checks and failed-upgrade triage.
• Maintain cost per install in engineering time and cloud spend.
• Work with customers' cloud and security teams to set deployment guardrails.

Required qualifications

• Build infrastructure as software in Pulumi, Terraform, or CDK.
• Write Go or TypeScript tooling.
• Run Kubernetes and Helm in production.
• Deep AWS experience, especially IAM, permission boundaries, Organizations, SCPs, and VPC networking.
• Experience running software in accounts not controlled by you, such as customer VPCs, on-prem, or regulated networks.
• Experience shipping versioned releases that customers upgrade on their own schedule.
• Ability to debug across layers including security groups, proxies, and TLS handshakes.
• Experience working directly with customers' platform and security teams.
• Experience designing or running systems where control plane and data plane are separate.
• Use of coding agents in infrastructure work.

Nice to have

• Experience building a BYOC, single-tenant, or self-hosted offering.
• Experience with cell-based architecture.
• GCP or Azure alongside AWS, including private connectivity.
• Workload identity and PKI in production: SPIFFE/SPIRE, cert-manager, private CAs.
• Experience with OAuth, OIDC, or mTLS.
• Interest in agent protocols like MCP.

Benefits

• Market-competitive salaries
• Generous equity packages (4-year vest, 1-year cliff)
• Health, dental, vision, and paramedical coverage for you and your family
• 4 weeks vacation
• 11 statutory holidays
• 1 volunteer day annually
• New MacBook Pro
• $500 stipend for peripherals
• Best AI tools available

About the company

Keycard is building identity and access infrastructure for the agent-native era. The founding team built and scaled Snyk, Auth0, HashiCorp, and Heroku.