Job Description
About Bastion
Bastion builds regulated financial infrastructure for modern businesses. Bastion’s full stack product suite covers stablecoin issuance, custodial wallet infrastructure, and global asset conversion rails, with the flexibility to deploy individual capabilities or combine them end-to-end.
Bastion’s regulated foundation underpins a compliance-first approach to risk management, ensuring the integrity and security of all financial activity within its systems. Bastion holds the appropriate licenses for its own operations, but can also act as a service provider, offering compliance and financial operations support under our customers’ licenses.
Work to Be Done
Instead of a list of requirements, we want to give you a directional look into the first 30, 90, and 180 days on the job.
We are a startup, so the pace is fast and the specific work will change. You need to be okay with that.
If you think this is something you can handle, we will be excited to speak with you.
We are open to US remote and have an office in New York City.
First 30 days: Learn the infrastructure, ship confidently
Ramp on AWS architecture, Terraform patterns, Kubernetes setup, CI/CD pipelines, and observability stack
Ship a small infrastructure improvement: Terraform module refactor, monitoring enhancement, or CI/CD optimization
Add runbooks, alerts, or documentation for the infrastructure areas you touch
Outcomes
Multiple safe infrastructure changes deployed with verification
You understand our core infrastructure patterns and can navigate Terraform, K8s, and AWS resources
Updated documentation and/or infrastructure-as-code improvements that help the team
By 90 days: Own an infrastructure domain and raise the bar
Take ownership of an infrastructure area: CI/CD pipelines, observability stack, Kubernetes platform, or AWS security/networking
Lead a medium-scope project: implementing a reusable Terraform module, right-sizing service resources, or improving deployment reliability
Strengthen system reliability with better metrics, alerts, autoscaling policies, and failure recovery mechanisms
Outcomes
A delivered infrastructure improvement that enhances reliability, reduces cost, or improves developer velocity
You’re a go-to person for your infrastructure domain
By 180 days: Drive platform-wide impact
Lead a platform-wide initiative: single immutable image pipeline, infrastructure standardization, database performance optimization, or security hardening
Shape infrastructure direction with design docs, RFC proposals, and mentoring engineering teams
Partner with engineering, security, and compliance teams to make pragmatic tradeoffs on reliability, cost, and regulatory requirements
Outcomes
A multi-sprint infrastructure delivery that improves system-wide reliability, security, or developer experience
Clear before/after improvements in deployment speed, cost efficiency, or operational stability
Patterns and tooling that enable engineers to ship faster and safer
Some problems you might work on
Building reusable Terraform modules that standardize service deployment patterns across dev, sandbox, and prod
Implementing single immutable image pipelines with built-in security scanning and promotion workflows
Right-sizing Kubernetes workloads and autoscaling policies to reduce cost while maintaining reliability
Designing and implementing database monitoring and performance optimization strategies
Hardening AWS infrastructure with security best practices: IAM policies, network segmentation, secrets management, and audit logging
Building observability infrastructure that gives engineers fast feedback on system health and performance
Improving CI/CD reliability and speed through better caching, parallelization, and failure handling
Our typical stack
Languages: Go and TypeScript/Node.js; some services in Rust as needed
Infrastructure-as-Code: Terraform
Cloud & Compute: AWS (ECS, EKS, Lambda, EC2), Kubernetes, Docker
CI/CD: GitHub Actions, container registries, automated testing and deployment pipelines
Data: Postgres (RDS), Redis, Kafka, Snowflake
Workflow Management: Temporal
Security: AWS Nitro Enclaves for hardware-backed key isolation, IAM policies, secrets management
Observability: Datadog, Grafana, Sentry, CloudWatch
Incident Management: Incident.io
Bastion provides equal employment opportunities to all employees and applicants for employment and prohibits discrimination and harassment of any type without regard to race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by federal, state or local laws. This policy applies to all terms and conditions of employment, including recruiting, hiring, and placement. Bastion participates in E-Verify to authorize eligibility of employment in the United States.
