Infrastructure Architect

Role overview

You will own the cloud, identity, and security layer that enables Dealstitch AI agents to run safely in production. The core challenge is allowing agents to connect to a firm’s systems through MCP servers while acting with the same permissions as the invoking user—without expanding security exposure.

Responsibilities

• Own how agents and MCP servers are deployed and hosted across Azure, AWS, and Google Cloud.
• Implement identity and access so agents run with user-equivalent permissions using SSO, OAuth, and Microsoft Entra (avoiding overly broad service accounts).
• Build connectivity and isolation for access to private systems with no public internet exposure, including:
  • Private endpoints
  • Sandboxes
  • MCP tunnels
• Manage secrets and credentials and enforce least-privilege access.
• Implement logging and observability to provide a clean audit trail of agent actions, without persisting PII outside the client environment.
• Partner with client IT and security teams to meet requirements (e.g., M365/identity setup, data residency, and security review).

Requirements

• Strong cloud/platform engineering experience across at least two major clouds (Azure, AWS, or Google Cloud), with real depth in one.
• Hands-on identity and access experience with SSO, SAML, OAuth, and Microsoft Entra/M365 administration.
• Security-first mindset: least privilege, secrets management, network isolation, and audit logging.
• Comfort owning deployments end-to-end and navigating client IT/security review processes.
• Familiarity with:
  • Containers (Docker, Kubernetes)
  • Infrastructure as Code (Terraform or similar)
  • CI/CD

Preferred

• Experience in financial services or other regulated environments.