Senior AI Infrastructure Engineer

You will own the platform our products and agents run on: the gateway every model call passes through, the runtime for our production agents, and the clusters, data stores, pipelines, secrets and release paths underneath.

We're hiring two engineers, one in San Francisco and one in Shanghai. One will lean toward the AI platform and the other toward the core platform. You'll share ownership and on-call, and work closely with our CTO.

This role is onsite five days a week. On-call includes nights and weekends, and days often run past 10 hours.

Why this role: You'll own the whole platform, work directly with our CTO, and build the agents that run it.

We run production AI across text, speech and video, mostly through third-party model APIs, with some self-hosted serving. The gateway supports internal teams, our products and customers. We do not train models. If you only want to work on model training, look elsewhere. If you want to make a multi-provider AI stack reliable, secure and affordable, keep reading.

Product teams own product features. IT support, marketing sites and SEO sit outside this role.

• Join on-call and run an incident review.
• Take a new model from benchmark to production traffic.
• Reconcile one month of gateway usage against provider invoices.
• Cut manual access requests in half.
• Put one recurring request or alert under agent handling, with a person approving risky actions.
• Make sure a second person can run each critical system.

• 5+ years running production infrastructure, with real on-call experience
• Deep Kubernetes debugging, including stateful workloads, and hands-on experience running Kubernetes on bare metal: storage, networking, upgrades and node failure
• Hands-on work with LLM APIs in production: routing, rate limits, streaming, failure modes and cost
• You've handed real operational work to agents or automation, with guardrails, approvals and recovery when a run dies
• Enough Go or Python to read an unfamiliar codebase and ship a fix
• Hands-on observability: you can maintain Grafana, Prometheus and OpenTelemetry collectors, write metric and log queries, and build a dashboard people use

• LiteLLM or a similar LLM gateway
• LLM serving, such as SGLang or vLLM
• Multi-tenant API platforms, including metering and billing
• Data pipelines, such as Airbyte, Airflow or CDC into BigQuery
• Realtime audio or WebSocket services
• Agent sandboxing, such as gVisor, Landlock or agent-sandbox
• Langfuse or other LLM tracing
• Remote dev environments, such as Coder
• FinOps across several clouds
• Mandarin

How we hire A detailed application form, an online assessment, a technical interview, a 30-minute deep dive with our CTO on a project you've built, then a paid work trial before any offer. You'll see how we work and we'll see how you work.

• Run the model gateway. Own routing, fallbacks, provider failover, rate limits and rollouts for 90+ model deployments across OpenAI, Anthropic, Azure, Google and AWS Bedrock. Benchmark new providers on latency, quality, cost and failure behavior before they take traffic, and escalate to vendors when they fall short.
• Make the gateway multi-tenant. Give each team and customer the right keys, routes, limits and usage metering, and reconcile usage against provider invoices.
• Run the AI developer platform. Own shared coding-agent access, including seats, quotas and per-user limits, plus the remote workspaces our engineers use. One heavy user should never slow down everyone else.
• Run production agents safely. Own sandboxing, credential scoping and pinned releases for long-running agents on Kubernetes.
• Automate your own job. Expect to build a lot of autonomous infra workflows and infra agents that take on routine requests and alerts, with a person approving risky actions.
• Own infrastructure and AI spend. Reconcile provider bills against usage, tie spend to a team and product, and catch anomalies early. Right-size clusters, spend vendor credits before they expire, and handle quota and billing escalations with cloud and model vendors.

• Keep clusters and cloud healthy. Debug and upgrade EKS, AKS and bare-metal k3s through Argo CD and Kustomize. Manage AWS, Azure and GCP through reviewed Terraform.
• Run the edge. Own Cloudflare across a dozen domains: DNS, WAF, TLS, CDN and object storage, plus GeoDNS, load balancers, egress IPs and email authentication.
• Ship new services fast. Point a coding agent at an open-source repo and have it in production the same day: manifests or Helm, pinned images, Postgres and Redis, SSO, DNS, TLS, secrets and backups, all through GitOps. Make it highly available when it needs to be, and give each service a named owner. Build production infrastructure for new product launches the same way.
• Hack your way to a solution. When something blocks you, read the source, patch it, work around it or build what's missing. You always have one more way to solve the problem.
• Lead migrations. Move workloads between regions, clouds and platforms with a tested rollback, retire what's left behind, and bring stray services under GitOps.
• Operate the data layer. Upgrade and migrate production PostgreSQL, MySQL, ClickHouse and Redis, run schema changes safely, and prove backups by restoring them.
• Keep data pipelines flowing. Run Airbyte, Airflow, Dataform and CDC into BigQuery so product and finance data stay fresh, and catch a stalled sync before it fills a production disk.

• Own reliability. Set SLOs and alerts people trust, lead incidents across infrastructure and product services, including realtime speech, write the reviews, and automate the triage you keep repeating.
• Own observability. Keep metrics, logs and traces flowing and usable across every cluster and the gateway. Maintain Grafana, Prometheus, Loki and Datadog, build on OpenTelemetry, add telemetry to new services, and manage retention and cost, so engineers and agents can see what's happening without asking you.
• Own infrastructure security. Rotate credentials, replace static keys with workload identity, find exposed secrets and vulnerable dependencies, respond to exposures, and control access to customer data.
• Make access self-serve. Replace manual grants with SSO, workload identity and scoped secrets, so engineers get what they need without asking you. Own the OAuth clients and API apps we run on ad and commerce platforms, including their reviews.

• Give product teams a paved road. Build the release pipelines, canaries, preview environments and guardrails that let them ship and operate their own services.
• Review and teach. Review infrastructure changes from engineers, founders and their agents, and share the runbooks and agent skills that keep everyone fast.

• GitOps and Terraform in production, ideally across more than one cloud
• Networking fundamentals: DNS, TLS, load balancing, WAF and routing
• You've taken a third-party service to production end to end, including SSO, backups and upgrades
• You've led a region, cloud or database migration with a tested rollback
• You've cut a real cloud or AI bill and can show the numbers
• Security judgment: least privilege, secret handling, credential rotation, safe rollouts
• Daily use of coding agents, plus clear views on what they should not touch unreviewed
• You follow the current agent landscape, including Hermes Agent, OpenClaw, open-source Codex and Vercel's eve, and can explain agent harness best practices: durable runs, sandboxing, scoped credentials, human approval, memory, tracing and evals
• The confidence to say no to a risky change and explain why, including to a founder
• Written English for daily work with teammates in the US, China and India

Hellyeah is the agentic operating system for distribution. AI agents plan, execute and optimize growth work, and humans approve it. A small engineering team runs several live products, with coding agents as part of how we ship.