Staff Engineer

A2Z; Denver (CO); Hybrid; USD 170,000 - 250,000; Full time

Benefits offered by this job

Health, dental & vision (employer-paid

Flexible Denver hybrid or remote US

401(k) with company match

Generous PTO

Disability coverage

Life & AD&D insurance

Mental health support

Pet insurance options

Identity theft protection

On-site gym & stocked kitchen

Job summary

A2Z Sync is seeking a hands-on engineer to design, build, and operate agentic AI systems (AWS Bedrock AgentCore, MCP servers) that observe dealer context and take action. You will own SRE practices, implement secure release gates, and guide modernization of legacy platforms while collaborating across teams.

You will drive adoption of agent-assisted development, upgrade frameworks, monitor dependencies, and ensure a high bar for security and reliability across the organization.

Qualifications

• 6+ years of software engineering experience, incl. Senior/Staff level
• Hands-on agentic/LLM development with modern frameworks
• Strong AWS serverless experience (Lambda, EventBridge, DynamoDB, Step Functions)
• Security-minded engineering with dependency/vulnerability management
• SRE practices: observability, SLOs, on-call, incident response
• CI/CD and release management including gates and rollback
• Two or more languages (Python, Java, TypeScript) and ability to read/modify PHP

Responsibilities

• Design, build, and operate agentic AI systems in production
• Drive adoption of agentic development harness across the org
• Manage security vulnerabilities and upgrade frameworks/libraries
• Modernize platforms and retire legacy patterns
• Own production monitoring, SRE practices, and release governance
• Standardize third-party integration observability and anomaly detection
• Maintain on-call cookbook with runbooks and tooling
• Enforce engineering standards and guardrails across teams
• Collaborate across the org to raise technical and security bars

Skills

Agentic development

AWS serverless

Security-minded

SRE/Observability

CI/CD & release

Multi-language proficiency

Standards enforcement

Tools

LangChain/LangGraph

Playwright

Snyk/Dependabot

Datadog

PagerDuty

OpenTelemetry

CloudFormation

Job description

We operate a multi-tenant automotive SaaS platform serving thousands of dealer groups across the United States. Our backend — event-driven serverless on AWS — orchestrates everything from dealer onboarding to inventory management to real-time transaction processing. That platform works. Now we need to make it think — and keep it modern, secure, and safe to ship. We also run a monolith that needs upkeep while we build the next-gen platform and redesign its components, a few at a time, into microfrontends.

This is a hands-on engineering role at its core. Day to day you build, ship, and operate agentic AI systems — autonomous, tool-using agents (AgentCore, MCP servers) that observe platform state, reason over dealer context, and take action through production APIs. But you are also the engineer who keeps the whole platform current and trustworthy: you continuously hunt and fix security vulnerabilities, upgrade the frameworks and runtimes underneath us, drive adoption of an agentic development harness to speed up delivery, and lead modernization of our existing systems.

You work across the org, not inside one team's walls. You own production monitoring and the SRE practices that keep us reliable, and you are the champion for safe releases — defining the checks and balances that gate production, setting the engineering standards, and making sure they are actually enforced. When something misbehaves in production, your instrumentation, your guardrails, and your release discipline are what make it fail safe instead of fail loud.

Reports to: SVP, Engineering.

What You'll Own

• Hands-on agentic development — designing, building, and operating agentic AI systems (AWS Bedrock AgentCore, MCP servers) every day: agent code, tool interfaces, evaluation harnesses, and production AI workflows
• Driving adoption of the agentic development harness — making agent-assisted development a first-class way the org ships, and measurably improving speed of delivery across teams
• Security vulnerability management — continuously monitoring for vulnerabilities (dependencies, CVEs, container images, IAM/config drift), remediating quickly, and keeping frameworks, libraries, and runtimes patched and upgraded
• Platform modernization — creating and driving initiatives to modernize existing platforms: retiring legacy patterns, adopting current frameworks, and staying close to the leading edge
• Production monitoring & SRE — owning observability (OpenTelemetry, CloudWatch), SLOs and error budgets, on-call and incident response
• Third-party integration observability — a standardized way to organize all third-party integration calls, report on them with precision, and run anomaly detection on call volumes with continuous monitoring, so a spike, drop, or failure surfaces before it becomes an outage or a cost problem
• On-call cookbook — keeping applications well documented so an on-call engineer can quickly query a cookbook, understand the likely problem areas, and know where to look
• Release governance — champion across releases: defining and enforcing the checks and balances (CI/CD quality gates, security and test gates, rollback criteria, progressive delivery) required to move change into production
• Setting and enforcing engineering standards — establishing the patterns, guardrails, and review bar the org follows, and holding the line so they are consistently applied
• Working across the org — partnering with every engineering team to raise the technical, security, and reliability bar broadly

Tech & Tools

• Cloud: Lambda, EventBridge, DynamoDB, S3, ECS Fargate, Aurora, API Gateway, CloudWatch, Secrets Manager
• AI & Agentic: AWS Bedrock AgentCore, MCP servers, LangChain/LangGraph
• Languages: Python and Java (Spring Boot), TypeScript/React (Next.js), legacy PHP/Laravel
• Security: Dependabot/Snyk, SAST/DAST, container image scanning, secrets management, IAM hardening
• Reliability & Observability: OpenTelemetry, CloudWatch, SLO/error-budget tooling, PagerDuty, Datadog
• CI/CD & Release: CircleCI, CloudFormation, progressive delivery, quality/security gates, rollback automation
• Integration Surfaces: REST, SOAP/XML, EventBridge, SES, Playwright

How You'll Use AI

This is not a "we are AI-curious" company. This is the role that makes agent-assisted development the norm for everyone else — building and operating production agents, triaging CVEs and generating patch/upgrade PRs, driving framework upgrades, reviewing PRs across the stack, standing up observability, and drafting ADRs and runbooks.

Hands-On Expectations

Roughly 60-70% building and operating, 20-30% on design and standards, and :10% on cross-team enablement.

First 12 Months

• Months 1-3: Immerse in the codebase, ship your first meaningful changes, audit our security posture, dependency/framework currency, and release pipeline, and publish a baseline of engineering standards and release checks
• Months 4-6: Ship agentic automation into at least one production workflow, roll out the agentic development harness, stand up the SRE baseline (SLOs, on-call, dashboards), and automate vulnerability scanning and patching
• Months 7-9: Drive a modernization initiative end to end; harden the release gates and enforce them across teams
• Months 10-12: Measurable delivery-speed gains from agentic adoption, production reliability against SLOs, and engineering standards adopted org-wide

Requirements

Must Have

• 6+ years of software engineering experience, including 2+ years at a Senior or Staff level building and operating production systems
• Hands-on agentic / LLM development (AWS Bedrock, MCP, LangChain/LangGraph) — or a strong, demonstrated track record of getting up to speed fast on modern frameworks
• Strong hands-on experience with AWS serverless (Lambda, EventBridge, DynamoDB, Step Functions) and traditional service architectures (ECS, RDS, API Gateway)
• Security-minded engineering — dependency and vulnerability management, timely patching/upgrades, and secure-by-default practices
• SRE practices — observability, SLOs/error budgets, on-call, and incident response
• CI/CD and release management — quality/security gates, rollback, and progressive delivery
• Comfortable in at least two of Python, Java (Spring Boot), and TypeScript/React — and able to read and safely modify PHP
• A track record of setting standards and getting them enforced, plus the writing to make a design or standard clear enough for a peer to implement

Strongly Preferred

• Experience running security tooling (Snyk/Dependabot, SAST/DAST) and observability/on-call tooling (Datadog, PagerDuty) in production
• Automotive, fintech, or multi-tenant marketplace platform experience
• Experience with data pipelines (Glue/Athena) or ETL/data-lake tooling
• Familiarity with Auth0, or with browser automation (Playwright) in production integration flows

Role Specifics

• Location: Denver, CO (hybrid, 2 days/week in office) or Remote (US, outside the Denver market)
• Employment type: Full-time
• Reports to: SVP, Engineering

Scope & Scale

• 5,000+ destination dealer tenants, each with isolated databases and per-tenant configuration
• Billions in annual GMV flowing through platform transactions
• Tens of thousands of API requests per minute across REST, SOAP, and event-driven integration surfaces
• Data pipelines spanning 6 integration domains with multi-protocol vendor connectivity

Benefits

At A2Z Sync, we replace the friction of disconnected systems with the velocity of a single platform. We pride ourselves on a fun, casual, and collaborative culture, and we're committed to our employees' well-being.

• Employer-Paid Health, Dental, and Vision Insurance, starting on day one
• Flexible work: Denver hybrid (2 days/week in office) or fully remote anywhere in the US
• 401(k) Retirement Plan with Company Match
• Generous Paid Time Off: Unlimited PTO and 10 paid holidays
• Short-Term and Long-Term Disability Coverage, fully employer-paid
• Life and AD&D Insurance, employer-paid
• Free Mental Health Support via BetterHelp
• Pet Insurance options
• Identity Theft Protection
• On-site gym in Denver, great co-workers, and a stocked kitchen with snacks and beverages