Staff Backend Engineer

About Kaseya

Kaseya is the leading provider of AI-powered IT management and cybersecurity software serving Managed Service Providers (MSPs) and internal IT organizations worldwide. Our comprehensive platform helps organizations efficiently manage secure and automate their IT environments driving operational efficiency and long-term business success.

Backed by Insight Partners a leading global software investor Kaseya has experienced sustained double-digit growth and continues to expand its global footprint. Today Kaseya supports customers in more than 20 countries and manages over 15 million endpoints worldwide.

Founded in 2000 Kaseya has built a culture centered around innovation accountability and results. We are a high-growth high-performance organization that values individuals who are driven adaptable and committed to delivering exceptional outcomes for our customers and teammates alike.

At Kaseya success comes from embracing challenges moving with urgency and continuously raising the bar.

Position Summary:

• Kaseya is looking for a Platform Backend Engineer to build and operate the core platform services powering Fleet connecting the execution runtime identity layer event routing secret management and audit infrastructure. This role focuses on high-reliability backend and platform engineering where correctness security scalability and operational clarity are critical.
• Build and operate the platform services that underpin Fleet: API gateway Kafka-based event routing (PSA webhooks and RMM alerts Temporal workflow triggers) Zitadel integration for machine identity and capability grant management and ClickHouse-backed immutable audit ledger writes
• Implement the Secret Management and KMS abstraction layer: pluggable KEK backends (AWS KMS Azure Key Vault GCP Cloud KMS BYOK) envelope encryption via AWS Encryption SDK per-client cryptographic isolation
• Build the capability grant enforcement pipeline: per-workflow per-client per-operation grants issued by Zitadel and validated by the sidecar Identity and Capability Engine on every inbound request
• Own the GitOps-based automation catalog deployment pipeline: workflow definitions versioned in Git deployed to per-client Temporal namespaces via CI/CD
• Build operational tooling for MSP onboarding: Zitadel org provisioning compliance tier configuration per client org and per-client KMS setup
• Contribute to the Safe Connector Layer: vendor API wrapper services (ConnectWise NinjaOne M365/CIPP Datto IT Glue CrowdStrike Huntress) that enforce scope inject platform-managed credentials and log every call before execution.

Required Qualification:

• Strong backend engineering in Go or Rust; we are moving away from Java-heavy backgrounds for new platform work
• Experience building event-driven systems: Kafka event sourcing patterns at-least-once delivery guarantees
• Familiarity with Temporal or another durable workflow engine
• Experience with identity and access management systems: OAuth 2.0 OIDC token lifecycle management fine-grained authorization models
• Solid understanding of encryption patterns: envelope encryption key hierarchy design KMS integrations
• Comfort operating in multi-tenant regulated environments where correctness and audit evidence are non-negotiable
• Strong observability instincts: structured logging distributed tracing metrics : you instrument what you build

Preferred Qualification:

• Experience with Zitadel Keycloak or similar identity providers
• ClickHouse or other columnar/append-only store experience
• Prior work in MSP tooling PSA/RMM API integrations or compliance-adjacent infrastructure (CMMC HIPAA SOC 2)

Additional information
Kaseya provides equal employment opportunity to all employees and applicants without regard to race religion age ancestry gender sex sexual orientation national origin citizenship status physical or mental disability veteran status marital status or any other characteristic protected by applicable law.