CLOUD BACKEND ENGINEER

Kastech Canada; Brea (CA); On-site; USD 120,000 - 180,000; Full time

Job summary

Kastech Canada is seeking a Cloud Backend Engineer to design, build, and operate backend services behind a scalable, multi-tenant cloud platform. You will own architecture, infrastructure-as-code, and production operations, writing Go services and defining AWS infrastructure with CDK.

You will work across edge and cloud, enforce strong security and isolation, and help scale event-driven pipelines. This is a high-ownership role on a senior team with opportunity to drive reliability and

Qualifications

• Go and Node/TypeScript backend experience.
• Hands-on AWS experience with Lambda, API Gateway, SQS, DynamoDB, S3, RDS/Aurora, Cognito, CloudWatch.
• Infrastructure as code with CDK (TypeScript) or Terraform/CloudFormation knowledge.
• Distributed systems expertise: event-driven architecture, queues, retries, idempotency.
• Experience designing multi-tenant SaaS backends with proper authn/authz and API gateway patterns.
• PostgreSQL familiarity including Row-Level Security would be a strong plus.
• CI/CD and containerization with Jenkins and Docker.
• Strong debugging, observability, and clear technical communication.

Responsibilities

• Design, build, and maintain backend services and APIs in Go, with supporting code and infrastructure in TypeScript.
• Define and operate cloud infrastructure on AWS using CDK — API Gateway, Lambda, SQS, DynamoDB, S3, RDS/Aurora PostgreSQL, Cognito, CloudFront, and WAF.
• Build and scale event-driven and device-to-cloud pipelines — telemetry and data ingestion, content/command delivery, retries, and offload/consolidation processing.
• Work across the cloud/edge boundary — services and agents running on edge/embedded Linux, using AWS IoT Greengrass and MQTT messaging.
• Strengthen multi-tenant isolation, identity, and security — PostgreSQL Row-Level Security, OAuth2/JWT, API gateway authorizers and middleware, edge protection, and encryption in transit and at rest.
• Own reliability and observability — structured logging, retry/back-off, latency tracing, and diagnosing concurrency and load problems.
• Write and maintain CI/CD and security scanning — Jenkins pipelines, Docker, remediation of dependency/container findings.
• Collaborate with architecture, firmware/edge, and product teams to define API and data contracts between devices and the cloud.
• Contribute to design reviews, participate in on-call/incident response, and help with release engineering for production systems.
• Nice to Have: IoT/device-to-cloud experience with AWS IoT Greengrass and MQTT.

Skills

Go backend

Node/TypeScript

AWS

CDK

PostgreSQL

CI/CD

Docker

Observability

Security

Edge/IoT

Tools

AWS CDK

Docker

Jenkins

Job description

About the Role

We're looking for a Cloud Backend Engineer to design, build, and operate the backend services behind a multi-tenant, event-driven cloud platform. You'll work across cloud services and device/edge connectivity, building reliable, scalable systems and owning them end-to-end — from architecture and infrastructure-as-code through to production operations. This is a hands-on, high-ownership role on a small, senior team. You'll write Go services, define your own AWS infrastructure in CDK, secure the API edge, and reason about the boundary between the device edge and the cloud.

What You’ll Do

• Design, build, and maintain backend services and APIs in Go, with supporting code and infrastructure in TypeScript.
• Define and operate cloud infrastructure on AWS using CDK — API Gateway, Lambda, SQS (including dead-letter/redrive queues), DynamoDB, S3, RDS/Aurora PostgreSQL, Cognito, CloudFront, and WAF.
• Build and scale event-driven and device-to-cloud pipelines — telemetry and data ingestion, content/command delivery, retries, and offload/consolidation processing.
• Work across the cloud/edge boundary — services and agents running on edge/embedded Linux, using AWS IoT Greengrass and MQTT messaging.
• Strengthen multi-tenant isolation, identity, and security — PostgreSQL Row-Level Security, OAuth2/JWT, API gateway authorizers and middleware, edge protection (CloudFront/WAF/Lambda@Edge), and encryption in transit and at rest (KMS/Secrets Manager).
• Own reliability and observability — structured logging with secret redaction, retry/back-off and idempotency, latency tracing, and diagnosing concurrency and load problems in ingestion and delivery paths.
• Write and maintain CI/CD and security scanning — Jenkins pipelines, Docker, and remediation of dependency/container findings (e.g., BlackDuck, Sysdig) across multiple environments.
• Collaborate with architecture, firmware/edge, and product teams to define the API and data contracts between devices and the cloud.
• Contribute to design reviews, participate in on-call/incident response, and help with release engineering for production systems.

What We’re Looking For

Required:

• Strong professional experience building backend services in Go and Node/Typescript (services, middleware, concurrency, testing).
• Hands-on experience with AWS — Lambda, API Gateway, SQS, DynamoDB, S3, IAM, Cognito, RDS/Aurora, CloudWatch — and comfort operating what you build.
• Experience writing infrastructure as code, ideally AWS CDK (TypeScript) (Terraform/CloudFormation experience translates).
• Solid understanding of distributed systems — event-driven architecture, message queues, retries/idempotency, dead-letter handling, eventual consistency, and fault tolerance.
• Experience designing and securing multi-tenant SaaS backends — tenant isolation, authn/authz (OAuth2, JWT), and API gateway patterns.
• Working knowledge of PostgreSQL — schema design, migrations, and query performance (Row-Level Security a strong plus).
• Comfort with CI/CD and containerization — Jenkins (or similar), Docker, and multi-environment promotion.
• Strong debugging and observability instincts, and clear technical communication.

Nice to Have:

• Experience with IoT / device-to-cloud systems — AWS IoT Greengrass, MQTT, device provisioning, fleet management, and telemetry pipelines.