Software Engineer – Infrastructure

Keycard Labs

. Own the BYOC product lifecycle, including installation, upgrades, support, security reviews, and documentation .

Posted 10/27/2026full-timeRemote • United States, CanadaMid-LevelSeniorWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in managing the BYOC product lifecycle, including installation, upgrades, and security reviews, while optimizing cloud spend and engineering time. Proficient in building infrastructure as code and collaborating with cross-functional teams to deliver customer-focused solutions.

Highest-signal resume keywords

Staff-Level Software Engineering ExperienceInfrastructure As Software With Pulumi, Terraform, Or CDKProduction Experience With Kubernetes And HelmDeep AWS Experience, Especially IAM And VPC NetworkingExperience Supporting Customer-Managed Software Through Upgrades

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Go ProgrammingTypeScript ProgrammingInfrastructure As CodeKubernetesHelmAWS IAMVPC NetworkingDebugging InfrastructureVersioned ReleasesSupport Matrices

Soft Skills

Clear CommunicationCollaborationProblem-Solving

Tools & Technologies

PulumiTerraformCDKKubernetesHelmAWSGCPAzureOAuthOIDC

Industry Keywords

BYOCInfrastructure As CodeCloud DeploymentSecurity ReviewsWorkload IdentityPKICustomer VPCsRegulated NetworksEscalation RotationsOn-Call Support

Tech Stack

Tools & technologies

AWSAzureCloudGoogle Cloud PlatformKubernetesTerraformTypeScriptGo

About the role

Key responsibilities & impact

Own the BYOC product lifecycle, including installation, upgrades, support, security reviews, and documentation
Define compatibility across clouds, regions, Kubernetes versions, SCPs, egress proxies, and deprecation policies
Build repeatable infrastructure-as-code cell deployments, account bootstrapping, and network patterns such as PrivateLink and certificates
Deliver releases to independently versioned cells with staged promotion, approval gates, rollback, observability, runbooks, and audited break-glass access
Build scoped-credential agents for pre-install checks, installations, failed-upgrade triage, and runbook drafting
Optimize engineering time and cloud spend per installation
Establish cell guardrails covering credential scope, isolation, workload identity, and PKI
Collaborate with founders, identity and policy engineers, customers, and customer security teams
Participate in escalation and on-call rotations
Take the first customer-hosted deployment from pre-production to production
Install a second customer deployment without bespoke work
Publish the first BYOC support matrix and upgrade policy
Agree a BYOC roadmap with product and engineering

Requirements

What you’ll need

Staff-level software engineering experience
Experience building infrastructure as software with Pulumi, Terraform, or CDK
Ability to write Go or TypeScript tooling
Production experience with Kubernetes and Helm
Deep AWS experience, especially IAM, permission boundaries, Organizations, SCPs, and VPC networking
Experience running software in accounts or environments not directly controlled, such as customer VPCs, on-premises, or regulated networks
Experience supporting customer-managed software through upgrades
Experience shipping versioned releases with support matrices and deprecation policies
Ability to debug across infrastructure and networking layers
Experience working directly with customers’ platform and security teams
Experience making product-versus-custom-work trade-offs
Ability to write clear plans and asynchronous updates
Experience using coding agents in infrastructure work and understanding where human review is required
Authorization to work in the United States or Canada is required
GCP or Azure experience, workload identity and PKI, OAuth/OIDC/mTLS, or MCP experience are strong-candidate additions

Benefits

Comp & perks

Generous equity package with 4-year vesting and a 1-year cliff
Health, dental, vision, and paramedical coverage for you and your family
4 weeks vacation
11 statutory holidays
1 volunteer day annually
Encouraged to take at least 2 weeks off each year to recharge
New MacBook Pro
$500 stipend for peripherals
Best AI tools available
Remote-first flexibility
Asynchronous collaboration
Huge autonomy and opportunity to gain mastery
Team accountability culture