Software Engineer, Infrastructure

keycard-labs; United States; Remote; USD 120,000 - 190,000; Full time

Benefits offered by this job

Health coverage

Dental coverage

Vision coverage

Paramedical coverage

Paid vacation (4 weeks)

Statutory holidays

Volunteer day

Equipment and peripherals

Equity

Job summary

keycard-labs is seeking an experienced Platform/DevOps Engineer to own the systems that build, release, and operate an infrastructure product across hosted environments and customer cloud accounts.

You will develop IaC patterns, set deployment guardrails, and build secure, repeatable upgradeable deployments with network and security considerations. This remote-first role targets North and South America with a market-competitive compensation.

Qualifications

• Experience building infrastructure as software with IaC tools (Pulumi, Terraform or CDK).
• Proficiency with Go or TypeScript tooling.
• Production Kubernetes and Helm experience.

Responsibilities

• Develop and maintain infrastructure-as-code, account bootstrap, and network patterns for customer deployments.
• Define supported clouds, regions, Kubernetes versions, compatibility limits, and deprecation practices for installations.
• Build a release pipeline with staged promotion, approval controls, rollback, and separation of control-plane and data-plane components.
• Establish availability targets, observability, incident runbooks, and safe support processes for customer environments.
• Create audited automation for pre-install checks, installation, upgrade diagnosis, and operational guidance; require engineer approval for customer-account changes.
• Collaborate with engineering, product, security, and customer teams to set deployment guardrails balancing reliability, cloud costs, and product needs.

Skills

Infrastructure as code

Go

TypeScript

Kubernetes

Helm

AWS networking

Tools

Pulumi

Terraform

CDK

Job description

Role overview

Own the systems that build, release, and operate an infrastructure product across hosted environments and customer cloud accounts. The work centers on making customer-managed deployments secure, repeatable, upgradeable, and as reliable as the hosted service, while creating shared tools and release processes for both.

Responsibilities

• Develop and maintain infrastructure-as-code, account bootstrap, and network patterns that let customers install and upgrade deployments with minimal bespoke work.


• Define supported clouds, regions, Kubernetes versions, compatibility limits, and deprecation practices for independently versioned installations.


• Build a release pipeline with staged promotion, approval controls, rollback, and separate handling of control-plane and data-plane components.


• Establish availability and durability targets, observability, incident runbooks, and safe support processes for customer environments without standing access.


• Create audited, tightly scoped automation for pre-install checks, installation, upgrade diagnosis, and operational guidance; require engineer approval for customer-account changes.


• Work with engineering, product, security, and customer teams to set deployment guardrails and balance reliability, cloud costs, and product-wide needs.

Requirements

• Experience building infrastructure as software with Pulumi, Terraform, or CDK, plus Go or TypeScript tooling; production Kubernetes and Helm experience.


• Deep AWS knowledge, particularly IAM, permission boundaries, Organizations policies, and VPC networking.


• Experience operating and upgrading software in environments outside your direct control, such as customer cloud accounts, private networks, or regulated settings.


• Track record shipping versioned software that customers upgrade independently, including compatibility guidance and planned deprecations.


• Ability to troubleshoot issues across application, network, proxy, TLS, and certificate layers, and to work directly with customer platform and security teams.


• Understanding of control-plane and data-plane separation, and practical experience using coding agents with human review where needed.

Nice to have

• Experience with bring-your-own-cloud, self-hosted, or single-tenant products; cell-based architecture; or private connectivity on GCP or Azure.


• Production experience with workload identity or PKI, such as SPIFFE/SPIRE, cert-manager, or private certificate authorities; familiarity with OAuth, OIDC, mTLS, or agent protocols.

Benefits and work setup

The role is remote-first, with asynchronous collaboration and hiring focused in North and South America.

• health, dental, vision, and paramedical coverage, four weeks of vacation, statutory holidays, a volunteer day, equipment and peripherals support, and equity.


• Compensation is described as market-competitive; no specific salary is provided.