keycard-labs - Software Engineer, Infrastructure
Requirements
• You build infrastructure as software in Pulumi, Terraform, or CDK, and write the Go or TypeScript tooling around it. You've run Kubernetes and Helm in production. • Deep AWS experience, especially IAM and permission boundaries, Organizations and SCPs, and VPC networking. • You've run software in accounts you don't control, like customer VPCs, on-prem, or regulated networks, and supported it through upgrades. • You've shipped versioned releases that customers upgrade on their own schedule, with a support matrix and deprecations they could plan around. • You debug across layers: a hung request that turns out to be a security group rule, a proxy that breaks a TLS handshake, a certificate challenge that can't reach the internet. • You've worked directly with customers' platform and security teams, and turned down a one-off when a product change was better. • You've made hard trade-offs to ship something now without boxing in the long-term system. • You write clear plans and async updates, and know when to jump on a call. • Agents at work. You already use coding agents in infrastructure work and have a clear view of where they're reliable and where a human has to review. • STRONG CANDIDATES MAY ALSO HAVE • Experience building a BYOC, single-tenant, or self-hosted offering at an infrastructure, data, or security company. • GCP or Azure alongside AWS, including private connectivity on those clouds. • Workload identity and PKI in production: SPIFFE/SPIRE, cert-manager, private CAs. • Experience with OAuth, OIDC, or mTLS, and interest in agent protocols like MCP. • YOUR FIRST 90 DAYS • Take our first customer-hosted deployment from pre-production to production with the customer. • Install for a second customer without bespoke work, starting from the templates, bootstrap, and pre-install checks the first one produced. • Publish the first BYOC support matrix and upgrade policy. • Agree a BYOC roadmap with product and engineering, including which operational work moves to agents. • WHO WILL LOVE THIS JOB • You want to build a product that runs in someone else's cloud and make it as solid as one you host. • You'd rather fix the product than repeat a custom install.
Responsibilities
• BYOC product. Own what it's like to install, upgrade, and get support for Keycard in a customer's cloud, from what their security team reviews to how each version is documented. • Compatibility. Decide what we support, from clouds, regions, and Kubernetes versions to customer guardrails like SCPs and egress proxies. Set the skew limits and deprecation policy that keep our control plane and customer cells compatible. • Cells everywhere. Make a new cell, ours or a customer's, a configuration change: infrastructure as code, account bootstrap, and network patterns like PrivateLink and certificates that work through customer proxies. For example: take a new customer's AWS account to a running, upgradeable cell with no standing access from us. • Releases. Get releases to many independently versioned cells with staged promotion, approval gates, and rollback. Operate those cells without standing access, with observability, runbooks, and audited break-glass. • Agent operations. Build agents for the repetitive work: pre-install checks, installs, failed-upgrade triage, and runbook drafts. They run with scoped credentials, every action is audited, and an engineer approves any change to a customer account. • Cost per install. Keep each install cheap in engineering time and cloud spend. Decide what's standard, what's configurable, and what we decline, so one customer's request doesn't become the roadmap. • Cell guardrails. Work through reviews with customers' cloud and security teams. With security, set the guardrails for every cell, from credential scope and isolation to workload identity and PKI, then build and run them.
Apply in one click
Upload My Resume
Drop here or click to browse · Tap to choose · PDF, DOCX, DOC, RTF, TXT