Senior AI Infrastructure Engineer

Hellyeah; San Francisco (CA); On-site; USD 200,000 - 270,000; Full time

Job summary

Hellyeah AI in San Francisco is seeking a Senior Infrastructure Engineer to own the AI platform gateway, the runtime for production agents, and supporting clusters, data stores, pipelines, secrets and release paths. The role is onsite five days a week, with on-call including nights and weekends.

You’ll work with our CTO, sharing ownership with another engineer (Shanghai), and help build a reliable, multi-provider AI stack. Expect long days as you shepherd deployments and respond to incidents.

Qualifications

• 5+ years running production infrastructure, with real on-call experience.
• Deep Kubernetes debugging, including stateful workloads, and hands-on experience running Kubernetes on bare metal: storage, networking, upgrade

Responsibilities

• Own the AI platform gateway: routing, fallbacks, provider failover, rate limits and rollouts for 90+ model deployments across OpenAI, Anthropic, Azure, Google and AWS Bedrock.
• Make the gateway multi-tenant with per-team keys, routes, limits and usage metering.
• Run the AI developer platform: shared coding-agent access, quotas and per-user limits, plus remote workspaces for engineers.
• Operate production agents safely: sandboxing, credential scoping and pinned releases on Kubernetes.
• Own infrastructure spend: reconcile provider bills, right-size clusters and handle cloud/vendor billing with alerts.

Skills

Kubernetes

On-call experience

Production infrastructure

Tools

Argo CD

Kustomize

Terraform

GitOps

Job description

About Hellyeah AI

Hellyeah is the agentic operating system for distribution. AI agents plan, execute and optimize growth work, and humans approve it. A small engineering team runs several live products, with coding agents as part of how we ship.

The role

You will own the platform our products and agents run on: the gateway every model call passes through, the runtime for our production agents, and the clusters, data stores, pipelines, secrets and release paths underneath. We're hiring two engineers, one in San Francisco and one in Shanghai. One will lean toward the AI platform and the other toward the core platform. You'll share ownership and on-call, and work closely with our CTO. This role is onsite five days a week. On-call includes nights and weekends, and days often run past 10 hours.

Why this role

You’ll own the whole platform, work directly with our CTO, and build the agents that run it. We run production AI across text, speech and video, mostly through third-party model APIs, with some self-hosted serving. The gateway supports internal teams, our products and customers. We do not train models. If you only want to work on model training, look elsewhere. If you want to make a multi-provider AI stack reliable, secure and affordable, keep reading. Product teams own product features. IT support, marketing sites and SEO sit outside this role.

What you’ll do

The AI platform

• Run the model gateway. Own routing, fallbacks, provider failover, rate limits and rollouts for 90+ model deployments across OpenAI, Anthropic, Azure, Google and AWS Bedrock. Benchmark new providers on latency, quality, cost and failure behavior before they take traffic, and escalat…
• Make the gateway multi-tenant. Give each team and customer the right keys, routes, limits and usage metering, and reconcile usage against provider invoices.
• Run the AI developer platform. Own shared coding-agent access, including seats, quotas and per-user limits, plus the remote workspaces our engineers use. One heavy user should never slow down everyone else.
• Run production agents safely. Own sandboxing, credential scoping and pinned releases for long-running agents on Kubernetes.
• Automate your own job. Expect to build a lot of autonomous infra workflows and infra agents that take on routine requests and alerts, with a person approving risky actions.
• Own infrastructure and AI spend. Reconcile provider bills against usage, tie spend to a team and product, and catch anomalies early. Right-size clusters, spend vendor credits before they expire, and handle quota and billing escalations with cloud and model vendors.

The core platform

• Keep clusters and cloud healthy. Debug and upgrade EKS, AKS and bare-metal k3s through Argo CD and Kustomize. Manage AWS, Azure and GCP through reviewed Terraform.
• Run the edge. Own Cloudflare across a dozen domains: DNS, WAF, TLS, CDN and object storage, plus GeoDNS, load balancers, egress IPs and email authentication.
• Ship new services fast. Point a coding agent at an open-source repo and have it in production the same day: manifests or Helm, pinned images, Postgres and Redis, SSO, DNS, TLS, secrets and backups, all through GitOps. Make it highly available when it needs to be, and give each service a named owner. Build production infrastructure for new product launches the same way.
• Hack your way to a solution. When something blocks you, read the source, patch it, work around it or build what's missing. You always have one more way to solve the problem.
• Lead migrations. Move workloads between regions, clouds and platforms with a tested rollback, retire what's left behind, and bring stray services under GitOps.
• Operate the data layer. Upgrade and migrate production PostgreSQL, MySQL, ClickHouse and Redis, run schema changes safely, and prove backups by restoring them.
• Keep data pipelines flowing. Run Airbyte, Airflow, Dataform and CDC into BigQuery so product and finance data stay fresh, and catch a stalled sync before it fills a production disk.

Reliability and security

• Own reliability. Set SLOs and alerts people trust, lead incidents across infrastructure and product services, including realtime speech, write the reviews, and automate the triage you keep repeating.
• Own observability. Keep metrics, logs and traces flowing and usable across every cluster and the gateway. Maintain Grafana, Prometheus, Loki and Datadog, build on OpenTelemetry, add telemetry to new services, and manage retention and cost, so engineers and agents can see what's happening without asking you.
• Own infrastructure security. Rotate credentials, replace static keys with workload identity, find exposed secrets and vulnerable dependencies, respond to exposures, and control access to customer data.
• Make access self-serve. Replace manual grants with SSO, workload identity and scoped secrets, so engineers get what they need without asking you. Own the OAuth clients and API apps we run on ad and commerce platforms, including their reviews.

The team around you

• Give product teams a paved road. Build the release pipelines, canaries, preview environments and guardrails that let them ship and operate their own services.
• Review and teach. Review infrastructure changes from engineers, founders and their agents, and share the runbooks and agent skills that keep everyone fast.

Your first 90 days

• Join on-call and run an incident review.
• Take a new model from benchmark to production traffic.
• Reconcile one month of gateway usage against provider invoices.
• Cut manual access requests in half.
• Put one recurring request or alert under agent handling, with a person approving risky actions.
• Make sure a second person can run each critical system.

What you’ll bring

• 5+ years running production infrastructure, with real on-call experience
• Deep Kubernetes debugging, including stateful workloads, and hands-on experience running Kubernetes on bare metal: storage, networking, upgrade