---
title: 'Software Engineer, Infrastructure at Keycard Labs'
canonical: 'https://feeny.ai/job/software-engineer-infrastructure-keycard-labs-united-states-8by3cnqm6ke4'
type: 'job'
last_seen: '2026-11-07'
---

# Software Engineer, Infrastructure at Keycard Labs

- **Company:** Keycard Labs
- **Location:** United States
- **Employment:** full-time
- **Work type:** remote
- **Posted:** 2026-10-27
- **Last confirmed live:** 2026-11-07
- **Apply:** https://jobs.ashbyhq.com/keycard-labs/4978734d-834d-4428-b3ac-aa6ca40c591d

## Job description

## About Keycard

At Keycard, we're building identity and access infrastructure for the agent-native era, where software isn't static but a dynamic, constantly changing system of AI agents working on behalf of people and businesses. Keycard gives every agent a verified identity and issues short-lived, task-scoped credentials at runtime, so agents can only do what they were asked to do, and every action is fully auditable. We're backed by a16z, Boldstart, and Acrew, and our founding team built and scaled Snyk, Auth0, HashiCorp, and Heroku.

## The Role

We're hiring two staff-level Software Engineers, Infrastructure to own how Keycard is built, shipped, and run. Keycard is a control plane for agents: identity, credential exchange, delegation, policy, and audit. Many of the enterprises adopting it need that control plane inside their own cloud, behind their network controls, with no standing access for us. Bring-your-own-cloud (BYOC) is a product at Keycard, not a services engagement. It's versioned, documented, and held to the same reliability and security bar as our hosted service. You'll own Keycard's build and release systems, our multi-tenant cloud, dedicated deployments, and deployments in customers' cloud accounts. Build common delivery and operating tools across them, with release safety, reliability, cloud cost, and repeatable installs as priorities. You'll work with founders, engineers, product, and customers, and agree escalation and on-call with engineering. We build on AWS (and later GCP and Azure), EKS, Pulumi, and Helm.

## What You'll Do

- BYOC product. Own what it's like to install, upgrade, and get support for Keycard in a customer's cloud, from what their security team reviews to how each version is documented.
- Compatibility. Decide what we support, from clouds, regions, and Kubernetes versions to customer guardrails like SCPs and egress proxies. Set the skew limits and deprecation policy that keep our control plane and customer-hosted deployments compatible.
- Deployments. Make a new deployment, ours or a customer's, a configuration change: infrastructure as code, account bootstrap, and network patterns like PrivateLink and certificates that work through customer proxies. For example: take a new customer's AWS account to a running, upgradeable deployment with no standing access from us.
- Releases. Own one pipeline from commit to running deployment, wherever it runs, with the control plane kept separate from the data plane. Get releases to many independently versioned deployments with staged promotion, approval gates, and rollback.
- Reliability. Set the availability and durability targets we hold ourselves to for the hosted service, with the observability, runbooks, and incident response behind them. Operate customer-hosted deployments without standing access, using audited break-glass.
- Agent operations. Build agents for the repetitive work: pre-install checks, installs, failed-upgrade triage, and runbook drafts. They run with scoped credentials, every action is audited, and an engineer approves any change to a customer account.
- Cost per install. Keep each install cheap in engineering time and cloud spend. Decide what's standard, what's configurable, and what we decline, so one customer's request doesn't become the roadmap.
- Deployment guardrails. Work through reviews with customers' cloud and security teams. With security, set the guardrails for every deployment, from credential scope and isolation to workload identity and PKI, then build and run them.

## What We're Looking For

- You build infrastructure as software in Pulumi, Terraform, or CDK, and write the Go or TypeScript tooling around it. You've run Kubernetes and Helm in production.
- Deep AWS experience, especially IAM and permission boundaries, Organizations and SCPs, and VPC networking.
- You've run software in accounts you don't control, like customer VPCs, on-prem, or regulated networks, and supported it through upgrades.
- You've shipped versioned releases that customers upgrade on their own schedule, with a support matrix and deprecations they could plan around.
- You debug across layers: a hung request that turns out to be a security group rule, a proxy that breaks a TLS handshake, a certificate challenge that can't reach the internet.
- You've worked directly with customers' platform and security teams, and turned down a one-off when a product change was better.
- You think in control plane and data plane: you've designed or run systems where the two are separate and upgrade independently.
- Agents at work. You already use coding agents in infrastructure work and have a clear view of where they're reliable and where a human has to review.

Strong Candidates May Also Have

- Experience building a BYOC, single-tenant, or self-hosted offering at an infrastructure, data, or security company.
- Experience with cell-based architecture.
- GCP or Azure alongside AWS, including private connectivity on those clouds.
- Workload identity and PKI in production: SPIFFE/SPIRE, cert-manager, private CAs.
- Experience with OAuth, OIDC, or mTLS, and interest in agent protocols like MCP.

## Your First 90 Days

- Take a customer-hosted deployment from pre-production to production with the customer.
- Make the next install need no bespoke work, starting from the templates, bootstrap, and pre-install checks.
- Ship a release through one delivery pipeline to hosted and customer-hosted deployments, with staged rollout and rollback.
- Write down availability and durability targets for the hosted service, with the alerts and runbooks behind them.

Who Will Love This Job

- You want to build a product that runs in someone else's cloud and make it as solid as one you host.
- You'd rather fix the product than repeat a custom install.

## What We Offer

- Build at the Frontier: Work every day at the frontier of agent-native systems — shipping, inventing, and iterating on technology that hasn’t been built before. You’ll be given huge autonomy, the opportunity to gain mastery, and the chance to work in a team that holds each other accountable to succeed.
- Truly Agent-Native Culture: At Keycard, we don’t just enable others to adopt agents — we use them ourselves to build. You’ll help shape an organization that embeds AI into its foundation as an enduring competitive advantage.
- Compensation With Upside: Market-competitive salaries and generous equity packages (4-year vest, 1-year cliff) give you the security to focus on building — and the asymmetric upside of ownership in a company chasing a category-defining mission.
- Comprehensive Benefits & Recharge: Health, dental, vision, and paramedical coverage for you and your family, plus 4 weeks vacation, 11 statutory holidays, and 1 volunteer day annually. We encourage at least 2 weeks off each year to fully recharge.
- Tools That Keep You Ahead: A new MacBook Pro, a $500 stipend for peripherals, and the best AI tools available so you can work at the forefront of agent-native workflows.
- Remote-First Flexibility: We are a remote-first team prioritizing asynchronous collaboration, with hiring focused in North and South America. Work where you’re strongest — we just want the best.

## About Keycard Labs

## Company Overview
- **One-liner**: Keycard Labs is building the identity and access management layer for the emerging agent economy, enabling developers to securely connect people, AI agents, and services across distributed systems with dynamic, scoped credentials.
- **Entity Type**: Private (Series A)
- **Headquarters**: Wilmington, Delaware, United States
- **Founded**: 2025
- **Founders**: Ian Livingstone (CEO), Matthew Creager, Jared Hanson

## Core Business
- **Primary industry**: Identity infrastructure, cloud security, developer tools
- **Target customers**: B2B – developers, platform engineers, and enterprises building AI agents and multi-agent systems
- **Mission statement**: “Redefine machine identity for the Internet—helping developers seamlessly connect people, agents, and services across networks, clouds, and applications.”

## Products & Services
- **Keycard STS (Security Token Service)**: An OAuth 2.1 authorization server that authenticates humans and agents and issues ephemeral, task-scoped tokens. Manages identity and access across zones, supports federation, workload identity, and agent-to-agent delegation.
- **Keycard CLI & SDKs**: Command-line tool and client libraries (Python, TypeScript) to run coding agents in policy-enforced sessions, add OAuth to MCP servers, and build custom agent-to-agent flows.
- **Keycard Admin Console**: Web interface for configuring identity policies, roles, SSO, audit logs, and billing.
- **Agentic Access Loop**: A patented architecture that introduces access control into the agentic loop, ensuring every agent action is authenticated, authorized, and audited.

## Market Standing
- **Valuation/Market Cap**: Not publicly disclosed
- **Key Metric**: **Total Funding** – $38M (Seed $8M in Apr 2025; Series A $30M in Nov 2025)
- **Notable Investors**: Andreessen Horowitz (led Series A), boldstart ventures, Acrew Capital, MANTIS Venture Capital, Essence VC, Matias Woloski, Ryan Carlson
- **Growth Signals**:
  - Headcount grew 1,550% YoY (from ~1–2 to 26 employees)
  - Acquired Anchor and Runebook to accelerate product and talent
  - Named to Redpoint’s InfraRed 100 in 2026
  - Delivered first production implementation of OAuth 2.1 Client ID Metadata Documents
  - Partnerships with OpenAI, Anthropic, Microsoft for interoperability

## Competitive Advantages
- **Agent-native identity**: Unlike traditional IAM (Okta, Auth0), Keycard issues dynamic, intent-based tokens instead of static API keys, enabling real-time, context-aware access control for autonomous agents.
- **Open standards leadership**: Contribution to MCP, WIMSE, and OAuth extensions for agents; first production implementation of OAuth 2.1 Client ID Metadata.
- **Founding team depth**: CEO Ian Livingstone (Infra Pod host), Matthew Creager (scaled Snyk from $30M to $300M ARR), Jared Hanson (creator of Passport.js, former Chief Architect at Auth0).
- **Agentic access loop**: A novel architecture that closes the loop between agent requests, policy evaluation, and credential issuance, providing full audit trails.

## Strategic Focus
- **Near-term**: Build the foundational trust fabric for the agent economy; expand integrations with major cloud providers and agent frameworks; grow open-source adoption.
- **Long-term**: Become the default identity layer for the internet’s agent-native systems, enabling safe delegation from pilot to production across industries.

## Why Work Here
- **Culture**: Deeply developer-first with a strong open-source ethos; team is distributed across the US, Canada, and UK with a heavy focus on engineering (48% technical roles).
- **Policy**: Likely remote-friendly given the distributed team; office presence in Wilmington, DE, with a small co-working-style hub.
- **Perks & impact**: Early-stage employee with significant ownership opportunity; work on cutting-edge problems at the intersection of AI, security, and identity; close collaboration with world-class investors (a16z) and industry leaders.
- **Engineering culture**: Strong emphasis on standards contributions, developer experience, and autonomy; small team (26 people) means each hire has outsized influence on product and direction.

## Sources
1. [LinkedIn – Keycard Labs](https://www.linkedin.com/company/keycard-labs)
2. [CB Insights – Keycard](https://www.cbinsights.com/company/keycard)
3. [Keycard Docs – How Keycard Works](https://docs.keycard.ai/guides/how-keycard-works/)
4. [Andreessen Horowitz – Investing in Keycard](https://a16z.com/announcement/investing-in-keycard/)
5. [Keycard Docs – Home](https://docs.keycard.ai/)

## Other roles at Keycard Labs

- [Software Engineer, Security](https://feeny.ai/job/software-engineer-security-keycard-labs-united-states-pk382974tazk) — United States
- [Software Engineer, SDK](https://feeny.ai/job/software-engineer-sdk-keycard-labs-united-states-a0shkerszhnm) — United States
- [Founding Revenue Marketing Lead](https://feeny.ai/job/founding-revenue-marketing-lead-keycard-labs-united-states-avf47jd0aa6g) — United States
- [Staff Product Marketing Manager](https://feeny.ai/job/staff-product-marketing-manager-keycard-labs-united-states-atsjzn1qk82p) — United States
- [Product Manager, Growth & Developer Experience](https://feeny.ai/job/product-manager-growth-developer-experience-keycard-labs-united-states-b4d0k638kbpj) — United States
- [Software Engineer, Infrastructure](https://feeny.ai/job/software-engineer-infrastructure-niantic-spatial-san-francisco-m57tjhm211kn) — San Francisco, CA
- [Software Engineer, Infrastructure](https://feeny.ai/job/software-engineer-infrastructure-databricks-mountain-view-atymthd6g8dk) — Mountain View, CA
- [Software Engineer, Infrastructure](https://feeny.ai/job/software-engineer-infrastructure-datologyai-san-mateo-hq-0svx94pvq6s8) — San Mateo Hq
- [Software Engineer, Infrastructure](https://feeny.ai/job/software-engineer-infrastructure-glomopay-bengaluru-x0352vet7x9k) — Bengaluru, India
- [Software Engineer, Infrastructure](https://feeny.ai/job/software-engineer-infrastructure-databricks-bengaluru-b6fam0n38r64) — Bengaluru, India