Senior Infrastructure Engineer

Aspiron Search; United States; Remote; USD 280,000 - 320,000; Full time

Benefits offered by this job

Equity

Job summary

Aspiron is hiring Senior/Staff Infrastructure Engineers to own and run multi-tenant cloud deployments across customer and internal environments. You will shape the platform, build reusable components, and ensure secure, scalable operations from day one.

Work in a modern IaC stack (Pulumi, Terraform, CDK) on AWS/EKS with Helm, while enabling Bring-Your-Own-Cloud deployments and strong guardrails. Equity is offered along with remote-friendly arrangements.

Qualifications

• Strong experience building infrastructure at scale in cloud environments.
• Proficiency in IaC with Pulumi, Terraform or CDK.
• Experience with AWS, IAM, SCPs, and VPC networks.
• Ability to own end-to-end platform deployments across customer clouds.

Responsibilities

• Own installation, upgrade, and support of the platform in customers’ clouds.
• Create reusable components and templates for customer deployments.
• Define standard vs configurable features for multi-customer deployments.
• Collaborate with customer platform and security teams and push back on bespoke requests when needed.
• Set cross-cloud guardrails and deployment policies.

Skills

Pulumi

Terraform

CDK

Go

TypeScript

Kubernetes

EKS

AWS IAM

VPC networking

Tools

AWS

EKS

Helm

Pulumi

Terraform

Job description

Senior/Staff Infrastructure Engineer (x2 Opportunities) - Remote within the US - $280-$320 + equity.

Aspiron are working with a market leader in the agentic control-plane/telemetry space who work with multiple enterprise clients already, integrating with their existing identity solutions to secure agentic processes.

Fresh out of stealth with a $25M+ Series A, they’re now looking to hire two Senior/Staff Software Engineers, Infrastructure with a dual mandate: Run the house, Run it in their clients’ clouds.

Their novel approach allows agents to obtain a verified identity set against a single task and policy/telemetry to confirm what it’s doing on every part of the tool call.

Why we like this client?

I could go on all day about what you can gain from the role and what skills you need, but honestly, it’s nicer to talk about why we like working with them:

• Friendly and encouraging team - no bs here
• Office in SF but can offer fully remote within the US (they meet about 2-3 times a year)
• They operate in one of the most invested areas of cyber right now, agentic identity. Morgan Stanley says it could more than double the identity security market, from $24BN to $60BN, within two years
• The agentic space is far from solved, you can contribute to a leading company looking to make sense through some of the AI noise out there
• Seniors here get good autonomy, not just building but owning the entire project/area
• The founders have a strong track record of building/scaling some of the best known developer/security and identity firms about.

Sounds good, what will I do there?

You’d join a small infra team, reporting directly to the company’s engineering leader. Together you’d own three layers: how the company builds and ships software, how it runs in their own multi-tenant cloud and dedicated deployments, and how it runs in customers’ cloud accounts.

The stack is AWS (GCP and Azure later), EKS, IaC/Terraform, Pulumi and Helm. Enterprise customers are onboarding onto the bring-your-own-cloud product right now, so this is live work from day one.

Make bring-your-own-cloud a product, not a project

No sale should need its own services team, so the job is building reusable components and knowing when to say no.

• Own installing, upgrading and supporting the platform in customers’ clouds, from their security review to versioned docs.
• Get a fresh customer AWS account to a live, upgradeable deployment with zero standing access.
• Build reusable components, from templates and account bootstrap to pre-install checks, so anything built for one customer gets reused for the next rather than rebuilt.
• Decide what’s standard, what’s configurable and what gets declined, so one customer’s request never becomes the roadmap.
• Work directly with customers platform and security teams, and push back on one-offs when a product change is the better answer.
• Set the support matrix across clouds, regions, Kubernetes versions and customer guardrails like SCPs and egress proxies.

Ship it and run it

• Own one pipeline from commit to running deployment, hosted or customer-hosted, with staged rollout, approval gates and rollback.
• Set availability and durability targets for the hosted service, with the observability and runbooks behind them.
• Operate customer deployments without standing access, using audited break-glass.
• Build agents for pre-install checks, installs and failed-upgrade triage, with an engineer approving any change to a customer account.
• Keep every install cheap in engineering time and cloud spend.

What you’ll bring

A software engineer first: you write infrastructure as code and build the tooling around it, not just operate it.

• Infrastructure as code in Pulumi, Terraform or CDK, with Go or TypeScript around it.
• Kubernetes and Helm run in production, ideally on EKS.
• Deep AWS: IAM and permission boundaries, Organizations and SCPs, VPC networking.
• Software you’ve run in accounts you don’t control, like customer VPCs, on-prem or regulated networks, and supported through upgrades.
• Versioned releases customers upgrade on their own schedule, with a support matrix and deprecations they can plan around.
• Enough enterprise deployments behind you to set a sensible baseline, without boxing your own team in with every customer’s constraints.
• Comfort in front of customers’ platform and security teams, and the judgement to turn a bespoke ask into a reusable component, or push back on it.
• Debugging across layers, like a timeout that turns out to be a security group or a proxy mangling TLS.
• Coding agents already in your infra workflow, and a clear sense of where a human still has to review.

Nice to have:

• A developer tools or infrastructure company background, or time at a mid-market or enterprise company that bought and rolled out this kind of software
• Built a BYOC, single-tenant or self-hosted offering at an infra, data or security company
• GCP or Azure alongside AWS, including private connectivity
• Workload identity and PKI (SPIFFE/SPIRE, cert-manager, private CAs)
• OAuth, OIDC or mTLS, and an interest in MCP