Sr Staff Infrastructure Systems Engineer

Astra Space Inc; Alameda (CA); On-site; USD 179,140 - 240,000; Full time

Benefits offered by this job

Competitive compensation

Equity and health benefits

Lunch and snacks provided

Job summary

Astra Space Inc in Alameda, California is seeking an experienced Infrastructure Systems Engineer to enhance internal systems regarding identity, endpoints, networks, and security. This role demands expertise in designing end-to-end infrastructure solutions for internal systems, known for operating in AI-forward engineering environments.

A qualified candidate should have over 12 years of experience and proven record in managing heterogeneous endpoint fleets, ensuring security compliance, and employing automation in IT processes. The pay range is $179,140-$240,000 annually.

Qualifications

• Proven experience building and owning infrastructure systems.
• Deep experience with identity systems and managing endpoint fleets.
• Hands-on experience with network security and automation.

Responsibilities

• Design and operate secure network infrastructure.
• Automate onboarding/offboarding processes.
• Eliminate manual IT work through scripting and tooling.

Skills

Infrastructure systems management

Identity systems

Endpoint management

Network security

Scripting and automation skills

Education

12+ years of experience in infrastructure systems

Experience in regulated environments (CMMC, ITAR)

Tools

Azure AD / Entra

MDM tools (Intune/Jamf/Kandji)

AWS GovCloud

Google Cloud Platform

Job description

We are looking for an Infrastructure Systems Engineer to build and own the internal platform that powers the company: identity, endpoints, networks, and security that will make company-wide impact.

Our engineering organization is AI‑forward. Our engineers use AI as a force multiplier in their daily work, design systems assuming AI‑assisted development and operations, and value experimentation and rapid adaptation.

The Opportunity

We are seeking an engineer who can deliver end‑to‑end infrastructure solutions that serve people and internal systems.

What This Role Is

• Identity (SSO, RBAC, lifecycle)
• Endpoints (Mac, Windows, Linux)
• Access (device trust, zero‑trust networking)
• Internal platform and automation
• IT Security & Compliance

How You'll Fulfill Your Mission

• Own identity as a first‑class system (SSO, RBAC, lifecycle, device trust)
• Build a fully automated onboarding/offboarding pipeline
• Design and operate endpoint infrastructure across Mac, Windows, and Linux
• Eliminate manual IT work through automation, scripting, and tooling
• Spend the majority of time building systems and automation—not responding to tickets
• Architect secure network infrastructure across office, lab, and remote environments
• Design and implement modern access patterns (e.g., WireGuard‑based networking, zero‑trust, device‑aware access)
• Own firewall and perimeter security (Palo Alto, Juniper, or equivalent)
• Enable secure, compliant access to cloud environments (AWS GovCloud, GCP Assured Workloads)
• Drive compliance (CMMC, ITAR) through systems —not paperwork
• Partner directly with engineering to remove friction and increase velocity
• High ownership and autonomy to define how these systems are built and operated

What We Value in You

• 12+ years proven experience building and owning infrastructure systems
• Deep experience with identity systems (Azure AD / Entra or equivalent; SAML/OAuth/SCIM)
• Strong experience managing heterogeneous endpoint fleets (Mac, Windows, Linux; MDM such as Intune/Jamf/Kandji)
• Hands‑on experience with network security and modern connectivity patterns (VPNs, WireGuard, zero‑trust networking)
• Strong scripting and automation skills (Python, Bash, or similar)
• Experience integrating systems via APIs and event‑driven workflows
• Experience operating in regulated environments (CMMC, ITAR, FedRAMP‑like)

What Sets You Apart

• You treat internal infrastructure like a product, not a helpdesk
• You automate everything that happens more than once
• You reduce complexity instead of adding it
• You think in terms of identity‑first and network‑minimized architectures
• You can debug across identity, network, endpoint, and cloud boundaries
• You have strong opinions about how systems should be built—and can back them up

Desired Multipliers

• Experience in GCC High environments (Microsoft Entra ID)
• Familiarity with Amazon Web Services GovCloud or Google Cloud Platform Assured Workloads
• Experience with WireGuard‑based networking or modern secure access platforms (e.g., Tailscale, Cloudflare Zero Trust)
• Experience supporting hardware, lab, or manufacturing environments
• Experience designing zero‑trust or device‑trust architectures

What Success Looks Like

• New hires are fully provisioned in minutes, not days
• Access is automated, auditable, and least‑privileged by default
• Network access is identity‑driven and device‑aware, not perimeter‑based
• Endpoint fleet is secure, compliant, and requires minimal manual intervention
• Engineers can move fast without being blocked by infrastructure
• Compliance is continuously satisfied through system design
• Systems are more secure, audits become trivial, and the company scales without friction

The pay range for this role is: $179,140-240,000 per year.

Salary and Benefits

We offer competitive compensation, equity, health, vision, dental, and 401(k) benefits. We provide lunch and snacks and drinks.

We will ensure that individuals with disabilities are provided reasonable accommodation to participate in the job application or interview process, to perform essential job functions, and to receive other benefits and privileges of employment. Please contact us to request accommodation.

ITAR Requirements: This position requires compliance with U.S. Government space technology trade restrictions, specifically the International Trafficking in Arms Regulations (ITAR), Export Administration Regulations (EAR) and additional regulations governing satellite, launch vehicle, missile, and other related technologies. All jobs restricted by these regulations will be contingent upon the applicant’s status as a documented U.S. Person or their ability to receive a trade license from the cognizant government agency; in addition to any required company background checks and in compliance with applicable U.S. and California laws. Similarly, positions requiring the ability to work on government contracts or a security clearance are also contingent upon the applicant’s ability to receive the appropriate clearance and be allowed to work on U.S. government contracts.

San Francisco Applicants: Astra will consider applicants with arrest and conviction records (criminal histories) in a manner consistent with the San Francisco Fair Chance Ordinance.