{"id":3301417,"url":"https://alion.io/job/keycard-software-engineer-infrastructure","title":"Software Engineer, Infrastructure","company":{"id":41879,"name":"Keycard","domain":"keycard.ai","url":"https://alion.io/company/keycard","size_band":"51-200","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Ashby","truth_index":null},"role":"Backend","role_family":"Backend","seniority":null,"employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"posting_text","remote_working_hours":null,"hiring_geo_confidence":"inferred","locations":[],"countries":[],"hiring_countries":["US","CA"],"hiring_countries_total":2,"salary":null,"salary_estimate":{"min_usd":121000,"max_usd":262000,"period":"year","method":"role_country_seniority_unknown","sample_n":9411},"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":true,"technologies":[{"name":"AI Agents","optional":false},{"name":"Amazon EKS","optional":false},{"name":"Auth0","optional":false},{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"Bootstrap","optional":false},{"name":"cert-manager","optional":false},{"name":"GCP","optional":false},{"name":"Helm","optional":false},{"name":"Heroku","optional":false},{"name":"IAM","optional":false},{"name":"Kubernetes","optional":false},{"name":"Model Context Protocol","optional":false},{"name":"PKI","optional":false},{"name":"Pulumi","optional":false},{"name":"Snyk","optional":false},{"name":"Terraform","optional":false},{"name":"TypeScript","optional":false},{"name":"JavaScript","optional":true}],"status":"live","first_seen_at":"2026-10-26T21:41:47Z","employer_posted_date":"2026-10-26","last_verified_at":"2026-11-02T19:49:26Z","board_verified":true,"closed_at":null,"days_open":6,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":6},"description":"About Keycard\nAt Keycard, we're building identity and access infrastructure for the agent-native era, where software isn't static but a dynamic, constantly changing system of AI agents working on behalf of people and businesses. Keycard gives every agent a verified identity and issues short-lived, task-scoped credentials at runtime, so agents can only do what they were asked to do, and every action is fully auditable. We're backed by a16z, Boldstart, and Acrew, and our founding team built and scaled Snyk, Auth0, HashiCorp, and Heroku.\nThe Role\nWe're hiring a staff-level Software Engineer, Infrastructure to build and own how Keycard is deployed and run: in our multi-tenant cloud, in dedicated single-tenant cells, and in our customers' own cloud accounts.\nKeycard is a control plane for agents: identity, credential exchange, delegation, policy, and audit. Many of the enterprises adopting it need that control plane inside their own cloud, behind their network controls, with no standing access for us. Bring-your-own-cloud (BYOC) is a product at Keycard, not a services engagement. It's versioned, documented, and held to the same bar as our hosted service.\nYou'll own BYOC end to end, along with the infrastructure that runs every Keycard cell. You'll work directly with founders, the engineers building our identity and policy services, and the customers running Keycard in their own cloud. Your priority is the platform that makes customer-hosted deployments repeatable. Installs and support shouldn't swallow the job; you'll agree to escalation and on-call with engineering. We build on AWS (and at some point - GCP, and Azure), EKS, Pulumi, and Helm.\nWhat You'll Do\nBYOC product. Own what it's like to install, upgrade, and get support for Keycard in a customer's cloud, from what their security team reviews to how each version is documented.\n\nCompatibility. Decide what we support, from clouds, regions, and Kubernetes versions to customer guardrails like SCPs and egress proxies. Set the skew limits and deprecation policy that keep our control plane and customer cells compatible.\n\nCells everywhere. Make a new cell, ours or a customer's, a configuration change: infrastructure as code, account bootstrap, and network patterns like PrivateLink and certificates that work through customer proxies. For example: take a new customer's AWS account to a running, upgradeable cell with no standing access from us.\n\nReleases. Get releases to many independently versioned cells with staged promotion, approval gates, and rollback. Operate those cells without standing access, with observability, runbooks, and audited break-glass.\n\nAgent operations. Build agents for the repetitive work: pre-install checks, installs, failed-upgrade triage, and runbook drafts. They run with scoped credentials, every action is audited, and an engineer approves any change to a customer account.\n\nCost per install. Keep each install cheap in engineering time and cloud spend. Decide what's standard, what's configurable, and what we decline, so one customer's request doesn't become the roadmap.\n\nCell guardrails. Work through reviews with customers' cloud and security teams. With security, set the guardrails for every cell, from credential scope and isolation to workload identity and PKI, then build and run them.\n\nWhat We're Looking For\nYou build infrastructure as software in Pulumi, Terraform, or CDK, and write the Go or TypeScript tooling around it. You've run Kubernetes and Helm in production.\n\nDeep AWS experience, especially IAM and permission boundaries, Organizations and SCPs, and VPC networking.\n\nYou've run software in accounts you don't control, like customer VPCs, on-prem, or regulated networks, and supported it through upgrades.\n\nYou've shipped versioned releases that customers upgrade on their own schedule, with a support matrix and deprecations they could plan around.\n\nYou debug across layers: a hung request that turns out to be a security group rule, a proxy that breaks a TLS handshake, a certificate challenge that can't reach the internet.\n\nYou've worked directly with customers' platform and security teams, and turned down a one-off when a product change was better.\n\nYou've made hard trade-offs to ship something now without boxing in the long-term system.\n\nYou write clear plans and async updates, and know when to jump on a call.\n\nAgents at work. You already use coding agents in infrastructure work and have a clear view of where they're reliable and where a human has to review.\n\nStrong Candidates May Also Have\nExperience building a BYOC, single-tenant, or self-hosted offering at an infrastructure, data, or security company.\n\nGCP or Azure alongside AWS, including private connectivity on those clouds.\n\nWorkload identity and PKI in production: SPIFFE/SPIRE, cert-manager, private CAs.\n\nExperience with OAuth, OIDC, or mTLS, and interest in agent protocols like MCP.\n\nYour First 90 Days\nTake our first customer-hosted deployment from pre-production to production with the customer.\n\nInstall for a second customer without bespoke work, starting from the templates, bootstrap, and pre-install checks the first one produced.\n\nPublish the first BYOC support matrix and upgrade policy.\n\nAgree a BYOC roadmap with product and engineering, including which operational work moves to agents.\n\nWho Will Love This Job\nYou want to build a product that runs in someone else's cloud and make it as solid as one you host.\n\nYou'd rather fix the product than repeat a custom install.\n\nWhat We Offer\nBuild at the Frontier: Work every day at the frontier of agent-native systems - shipping, inventing, and iterating on technology that hasn’t been built before. You’ll be given huge autonomy, the opportunity to gain mastery, and the chance to work in a team that holds each other accountable to succeed.\n\nTruly Agent-Native Culture: At Keycard, we don’t just enable others to adopt agents - we use them ourselves to build. You’ll help shape an organization that embeds AI into its foundation as an enduring competitive advantage.\n\nCompensation With Upside: Market-competitive salaries and generous equity packages (4-year vest, 1-year cliff) give you the security to focus on building - and the asymmetric upside of ownership in a company chasing a category-defining mission.\n\nComprehensive Benefits & Recharge: Health, dental, vision, and paramedical coverage for you and your family, plus 4 weeks vacation, 11 statutory holidays, and 1 volunteer day annually. We encourage at least 2 weeks off each year to fully recharge.\n\nTools That Keep You Ahead: A new MacBook Pro, a $500 stipend for peripherals, and the best AI tools available so you can work at the forefront of agent-native workflows.\n\nRemote-First Flexibility: We are a remote-first team prioritizing asynchronous collaboration, with hiring focused in North and South America. Work where you’re strongest - we just want the best.","description_format":"text","description_chars":6908,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"phd","optional":false},"security_clearance":false,"languages":[]},"benefits":["Apple Macbook","Equity"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"},{"name":"Canada","iso":"CA","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Artificial Intelligence","Identity Management","Information Security","AI Agents"],"lifecycle":[{"event":"open","at":"2026-10-26T23:48:57Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":6,"expected_fill_days":159,"reasons":["conf:3","win:early"],"computed_at":"2026-11-02T06:13:15Z"},"pay":null,"html_url":"https://alion.io/job/keycard-software-engineer-infrastructure","json_url":"https://alion.io/job/keycard-software-engineer-infrastructure.json","meta":{"generated_at":"2026-11-02T21:18:14Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":29758,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-03T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":41879},"rest":"https://alion.io/mcp/rest/get_company?id=41879"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fkeycard-software-engineer-infrastructure"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fkeycard-software-engineer-infrastructure"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fkeycard-software-engineer-infrastructure"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/keycard-software-engineer-infrastructure\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fkeycard-software-engineer-infrastructure"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3301417}},{"tool":"search_jobs","arguments":{"company":"keycard.ai","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3301417},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}