What We're Looking For

• You build infrastructure as software in Pulumi, Terraform, or CDK, and write the Go or TypeScript tooling around it. You've run Kubernetes and Helm in production.
• Deep AWS experience, especially IAM and permission boundaries, Organizations and SCPs, and VPC networking.
• You've run software in accounts you don't control, like customer VPCs, on-prem, or regulated networks, and supported it through upgrades.
• You've shipped versioned releases that customers upgrade on their own schedule, with a support matrix and deprecations they could plan around.
• You debug across layers: a hung request that turns out to be a security group rule, a proxy that breaks a TLS handshake, a certificate challenge that can't reach the internet.
• You've worked directly with customers' platform and security teams, and turned down a one-off when a product change was better.
• You think in control plane and data plane: you've designed or run systems where the two are separate and upgrade independently.
• Agents at work. You already use coding agents in infrastructure work and have a clear view of where they're reliable and where a human has to review.

Strong Candidates May Also Have

• Experience building a BYOC, single-tenant, or self-hosted offering at an infrastructure, data, or security company.
• Experience with cell-based architecture.
• GCP or Azure alongside AWS, including private connectivity on those clouds.
• Workload identity and PKI in production: SPIFFE/SPIRE, cert-manager, private CAs.
• Experience with OAuth, OIDC, or mTLS, and interest in agent protocols like MCP.

Your First 90 Days

• Take a customer-hosted deployment from pre-production to production with the customer.
• Make the next install need no bespoke work, starting from the templates, bootstrap, and pre-install checks.
• Ship a release through one delivery pipeline to hosted and customer-hosted deployments, with staged rollout and rollback.
• Write down availability and durability targets for the hosted service, with the alerts and runbooks behind them.

Who Will Love This Job

• You want to build a product that runs in someone else's cloud and make it as solid as one you host.
• You'd rather fix the product than repeat a custom install.

What We Offer

• Build at the Frontier: Work every day at the frontier of agent-native systems — shipping, inventing, and iterating on technology that hasn’t been built before. You’ll be given huge autonomy, the opportunity to gain mastery, and the chance to work in a team that holds each other accountable to succeed.
• Truly Agent-Native Culture: At Keycard, we don’t just enable others to adopt agents — we use them ourselves to build. You’ll help shape an organization that embeds AI into its foundation as an enduring competitive advantage.
• Compensation With Upside: Market-competitive salaries and generous equity packages (4-year vest, 1-year cliff) give you the security to focus on building — and the asymmetric upside of ownership in a company chasing a category-defining mission.
• Comprehensive Benefits & Recharge: Health, dental, vision, and paramedical coverage for you and your family, plus 4 weeks vacation, 11 statutory holidays, and 1 volunteer day annually. We encourage at least 2 weeks off each year to fully recharge.
• Tools That Keep You Ahead: A new MacBook Pro, a $500 stipend for peripherals, and the best AI tools available so you can work at the forefront of agent-native workflows.
• Remote-First Flexibility: We are a remote-first team prioritizing asynchronous collaboration, with hiring focused in North and South America. Work where you’re strongest — we just want the best.