Staff Backend Engineer

Position Summary:

• Kaseya is looking for a Platform Backend Engineer to build and operate the core platform services powering Fleet, connecting the execution runtime, identity layer, event routing, secret management, and audit infrastructure. This role focuses on high-reliability backend and platform engineering, where correctness, security, scalability, and operational clarity are critical.
• Build and operate the platform services that underpin Fleet: API gateway, Kafka-based event routing (PSA webhooks and RMM alerts Temporal workflow triggers), Zitadel integration for machine identity and capability grant management, and ClickHouse-backed immutable audit ledger writes
• Implement the Secret Management and KMS abstraction layer: pluggable KEK backends (AWS KMS, Azure Key Vault, GCP Cloud KMS, BYOK), envelope encryption via AWS Encryption SDK, per-client cryptographic isolation
• Build the capability grant enforcement pipeline: per-workflow, per-client, per-operation grants issued by Zitadel and validated by the sidecar Identity and Capability Engine on every inbound request
• Own the GitOps-based automation catalog deployment pipeline: workflow definitions versioned in Git, deployed to per-client Temporal namespaces via CI/CD
• Build operational tooling for MSP onboarding: Zitadel org provisioning, compliance tier configuration per client org, and per-client KMS setup
• Contribute to the Safe Connector Layer: vendor API wrapper services (ConnectWise, NinjaOne, M365/CIPP, Datto, IT Glue, CrowdStrike, Huntress) that enforce scope, inject platform-managed credentials, and log every call before execution.

Required Qualification:

• Strong backend engineering in Go or Rust; we are moving away from Java-heavy backgrounds for new platform work
• Experience building event-driven systems: Kafka, event sourcing patterns, at-least-once delivery guarantees
• Familiarity with Temporal or another durable workflow engine
• Experience with identity and access management systems: OAuth 2.0, OIDC, token lifecycle management, fine-grained authorization models
• Solid understanding of encryption patterns: envelope encryption, key hierarchy design, KMS integrations
• Comfort operating in multi-tenant, regulated environments where correctness and audit evidence are non-negotiable
• Strong observability instincts: structured logging, distributed tracing, metrics : you instrument what you build

Preferred Qualification:

• Experience with Zitadel, Keycloak, or similar identity providers
• ClickHouse or other columnar/append-only store experience
• Prior work in MSP tooling, PSA/RMM API integrations, or compliance-adjacent infrastructure (CMMC, HIPAA, SOC 2)