Staff Backend Engineer

About Kaseya

Kaseya is the leading provider of AI-powered IT management and cybersecurity software, serving Managed Service Providers (MSPs) and internal IT organizations worldwide. Our comprehensive platform helps organizations efficiently manage, secure, and automate their IT environments, driving operational efficiency and long-term business success.

Backed by Insight Partners, a leading global software investor, Kaseya has experienced sustained double-digit growth and continues to expand its global footprint. Today, Kaseya supports customers in more than 20 countries and manages over 15 million endpoints worldwide.

Founded in 2000, Kaseya has built a culture centered around innovation, accountability, and results. We are a high-growth, high-performance organization that values individuals who are driven, adaptable, and committed to delivering exceptional outcomes for our customers and teammates alike.

At Kaseya, success comes from embracing challenges, moving with urgency, and continuously raising the bar.

Position Summary:

• Kaseya is looking for a Platform Backend Engineer to build and operate the core platform services powering Fleet, connecting the execution runtime, identity layer, event routing, secret management, and audit infrastructure. This role focuses on high-reliability backend and platform engineering, where correctness, security, scalability, and operational clarity are critical.

• Build and operate the platform services that underpin Fleet: API gateway, Kafka-based event routing (PSA webhooks and RMM alerts → Temporal workflow triggers), Zitadel integration for machine identity and capability grant management, and ClickHouse-backed immutable audit ledger writes

• Implement the Secret Management and KMS abstraction layer: pluggable KEK backends (AWS KMS, Azure Key Vault, GCP Cloud KMS, BYOK), envelope encryption via AWS Encryption SDK, per-client cryptographic isolation

• Build the capability grant enforcement pipeline: per-workflow, per-client, per-operation grants issued by Zitadel and validated by the sidecar Identity and Capability Engine on every inbound request