Sr Staff Infrastructure Systems Engineer

Astra•Alameda, CA

164d•$179,140 - $240,000

About The Position

Astra is seeking an Infrastructure Systems Engineer to build and own the internal platform that supports identity, endpoints, networks, and security. This role focuses on infrastructure for people and internal systems, including identity and access management, endpoint infrastructure, secure connectivity, internal platform automation, and IT security and compliance. The position is primarily focused on building systems and automation rather than responding to tickets, with substantial ownership and autonomy to define how infrastructure is built and operated. The company describes its engineering culture as AI-forward, encouraging engineers to use AI tools in daily work, design systems for AI-assisted development and operations, and experiment with better tools. The role partners directly with engineering to reduce friction and increase velocity, while driving compliance through system design. Success means provisioning new hires quickly, providing automated and auditable least-privilege access, maintaining secure and compliant endpoints, enabling identity- and device-aware network access, and scaling with minimal infrastructure friction.

Requirements

12+ years of proven experience building and owning infrastructure systems.
Deep experience with identity systems such as Azure AD / Entra or equivalent, and SAML, OAuth, and SCIM.
Strong experience managing heterogeneous endpoint fleets across Mac, Windows, and Linux, using MDM tools such as Intune, Jamf, or Kandji.
Hands-on experience with network security and modern connectivity patterns, including VPNs, WireGuard, and zero-trust networking.
Strong scripting and automation skills in Python, Bash, or similar.
Experience integrating systems through APIs and event-driven workflows.
Experience operating in regulated environments such as CMMC, ITAR, or FedRAMP-like environments.
Ability to comply with applicable U.S. Government trade restrictions, including ITAR and EAR, or obtain a required trade license; relevant positions may also require eligibility to work on government contracts or receive a security clearance.

Nice To Haves

Experience in GCC High environments using Microsoft Entra ID.
Familiarity with AWS GovCloud or Google Cloud Platform Assured Workloads.
Experience with WireGuard-based networking or modern secure access platforms such as Tailscale or Cloudflare Zero Trust.
Experience supporting hardware, lab, or manufacturing environments.
Experience designing zero-trust or device-trust architectures.
Treating internal infrastructure like a product rather than a helpdesk function.
Automating recurring tasks, reducing complexity, and designing identity-first and network-minimized architectures.
Ability to debug across identity, network, endpoint, and cloud boundaries.

Responsibilities

Own identity systems, including SSO, RBAC, lifecycle management, and device trust.
Build a fully automated onboarding and offboarding pipeline.
Design and operate endpoint infrastructure across Mac, Windows, and Linux.
Eliminate manual IT work through automation, scripting, and tooling.
Architect secure network infrastructure across office, lab, and remote environments.
Design and implement modern access patterns, including WireGuard-based networking, zero-trust, and device-aware access.
Own firewall and perimeter security.
Enable secure, compliant access to cloud environments such as AWS GovCloud and GCP Assured Workloads.
Drive CMMC and ITAR compliance through systems rather than paperwork.
Partner directly with engineering to remove friction and increase velocity.
Build and operate internal infrastructure systems with high ownership and autonomy.