Staff Backend Engineer

Kaseya is the leading provider of AI-powered IT management and cybersecurity software, serving Managed Service Providers (MSPs) and internal IT organizations worldwide. Our comprehensive platform helps organizations efficiently manage, secure, and automate their IT environments, driving operational efficiency and long-term business success.

Backed by Insight Partners, a leading global software investor, Kaseya has experienced sustained double-digit growth and continues to expand its global footprint. Today, Kaseya supports customers in more than 20 countries and manages over 15 million endpoints worldwide.

Founded in 2000, Kaseya has built a culture centered around innovation, accountability, and results. We are a high-growth, high-performance organization that values individuals who are driven, adaptable, and committed to delivering exceptional outcomes for our customers and teammates alike.

At Kaseya, success comes from embracing challenges, moving with urgency, and continuously raising the bar. 

• Kaseya is looking for a Platform Backend Engineer to build and operate the core platform services powering Fleet, connecting the execution runtime, identity layer, event routing, secret management, and audit infrastructure. This role focuses on high-reliability backend and platform engineering, where correctness, security, scalability, and operational clarity are critical.
• Build and operate the platform services that underpin Fleet: API gateway, Kafka-based event routing (PSA webhooks and RMM alerts → Temporal workflow triggers), Zitadel integration for machine identity and capability grant management, and ClickHouse-backed immutable audit ledger writes
• Implement the Secret Management and KMS abstraction layer: pluggable KEK backends (AWS KMS, Azure Key Vault, GCP Cloud KMS, BYOK), envelope encryption via AWS Encryption SDK, per-client cryptographic isolation
• Build the capability grant enforcement pipeline: per-workflow, per-client, per-operation grants issued by Zitadel and validated by the sidecar Identity and Capability Engine on every inbound request
• Own the GitOps-based automation catalog deployment pipeline: workflow definitions versioned in Git, deployed to per-client Temporal namespaces via CI/CD
• Build operational tooling for MSP onboarding: Zitadel org provisioning, compliance tier configuration per client org, and per-client KMS setup
• Contribute to the Safe Connector Layer: vendor API wrapper services (ConnectWise, NinjaOne, M365/CIPP, Datto, IT Glue, CrowdStrike, Huntress) that enforce scope, inject platform-managed credentials, and log every call before execution.

• Strong backend engineering in Go or Rust; we are moving away from Java-heavy backgrounds for new platform work
• Experience building event-driven systems: Kafka, event sourcing patterns, at-least-once delivery guarantees
• Familiarity with Temporal or another durable workflow engine
• Experience with identity and access management systems: OAuth 2.0, OIDC, token lifecycle management, fine-grained authorization models
• Solid understanding of encryption patterns: envelope encryption, key hierarchy design, KMS integrations
• Comfort operating in multi-tenant, regulated environments where correctness and audit evidence are non-negotiable
• Strong observability instincts: structured logging, distributed tracing, metrics : you instrument what you build

• Experience with Zitadel, Keycloak, or similar identity providers
• ClickHouse or other columnar/append-only store experience
• Prior work in MSP tooling, PSA/RMM API integrations, or compliance-adjacent infrastructure (CMMC, HIPAA, SOC 2)