Infrastructure Engineer

What MatX Is Building

We're a small engineering team designing a custom chip. The work is compute-heavy and tooling-heavy: hermetic builds, large verification jobs, custom developer environments, a self-hosted CI fleet, and a steadily growing collection of internal services that engineers depend on every day. The infrastructure that supports all of this — CI/CD, compute, shared filesystems, networking, internal tooling — already exists and has a system owner. We're hiring a second infrastructure engineer to broaden our capacity and add depth in areas adjacent to what we already have.

We're looking for a strong generalist with a network and systems bent. Someone who's comfortable debugging a Linux kernel issue in the morning, untangling a cloud networking problem at lunch, and writing a new MCP server for an unfamiliar protocol in the afternoon.

What You'll Do Here

• Day to day, the work spans:

  • Linux and networking work (the core of the role)

    • Diagnose and fix issues across the OS, network, and cloud stack
    • Reason about routing, DNS, firewalls, VPCs, private connectivity, and trust boundaries
    • Track down "permission denied" that's actually a mount option, or "build is slow" that's actually a metadata-server timeout
    • Improve, harden, and extend the network and host configuration we already have

  • Building tools and integrations

    • Write internal tools, scripts, and small services that make the engineering team faster
    • Pick up unfamiliar protocols and codebases and ship working integrations against them

  • Supporting the infrastructure stack

    • Pair with the system owner on compute, CI, shared storage, developer VMs, and the Terraform-managed cloud setup; take ownership of areas as you grow into them, and cover when they're out
    • Execute and review production changes carefully — a bad apply can take down the shared filesystem

  • Helping engineers

    • Onboard new hires and debug their environment problems
    • Solve the kind of problems that start with "X is broken" and end with a fix three layers down the stack

Who You Are

• We care more about instincts and pattern recognition than a checklist of tools. The right person has seen enough systems like ours to know which questions to ask
• Deep Linux systems knowledge. You can debug from userspace down to syscalls and routing tables, and you've spent enough time with namespaces, mounts, and process semantics to recognize their failure modes on sight
• Deep networking. VPCs, DNS, firewalls, shared filesystems, private connectivity. Has opinions on when to reach for peering vs a private-service endpoint vs an identity-aware proxy vs an overlay network — and can articulate which choices expand the trust boundary and which don't
• Strong generalist instincts. You don't need a paved path to make progress. You'll learn enough of a build system to debug a remote-cache miss, ship a small service against a protocol you've never seen, or read upstream source to verify a claim — preferring the source over the docs when it matters
• Infrastructure-as-code experience on a major cloud. Comfortable in production: reading plans, reasoning about drift, executing migrations without taking the cluster down. We use Terraform on GCP; depth there is a plus, but the principles transfer and we'll happily talk to people coming from AWS, Azure, or other IaC tools
• Conservative about new patterns. When introducing a new module or tool, reads a few siblings first to pick up conventions. Spots and questions inherited patterns that don't apply to the new use case
• Threat-modeling instincts for shared infrastructure. Reasons about who can talk to what, what gets cached and trusted by whom, and the blast radius when something goes wrong. Distinguishes load-bearing security choices from defense-in-depth
• Operational thinking. Reasons about apply ordering, coordination windows, and "what fails first if X is misconfigured"
• Surgical git workflow. Knows the rebase tooling well enough that rewriting a branch isn't scary. Splits unrelated work into separate PRs. Never resorts to --no-verify or destructive shortcuts to make a problem go away
• This is a hybrid role that will require you to work from our Mountain View, CA office 3 days a week on Tuesday through Thursday

Bonus Points If You Have

• GCP depth specifically: IAM, managed compute, identity-aware proxies
• Bazel and remote build/cache internals; buildbarn or equivalent
• Operating batch compute or job schedulers — HPC, Slurm, Nomad, Kubernetes batch, or similar
• Working understanding of token-based auth and cloud identity flows
• Rust or Python scripting for tooling (not product code)
• EDA/semiconductor tool chain familiarity (Synopsys, Cadence)
• Managing fleets at the OS level: policies, images, package distribution
• You don’t need to write RTL or understand hardware architect but this is a plus
• You don't need to be a product-software engineer — but you should be able to read a build rule, a Rust error message, or a CI workflow and figure out what went wrong, and write small tools or services when the team needs one. This is another plus

Compensation

The US base salary for this full-time position is determined based on a variety of factors including role, experience, location, job related skills, and relevant education and training. Career length is only a guideline for compensation.

• Early Career - $160,000 - $275,000 + equity
• Mid Career - $175,000 - $400,000 + equity
• Senior Career - $250,000 - $600,000 + equity

What We Offer

• Time off: 4 weeks PTO (accrued) + 12 company Holidays + up to 3 weeks remote work
• Health: Company-subsidized Medical (Kaiser or Anthem) for employees & dependents, Guardian Dental and Vision insurances for employee & dependents, and life insurance (employee only), plus HSA and FSA offerings via Lively.
• Financial Wellbeing: Choose from Roth IRA or 401K (or both) retirement plans with up to 5% company contribution to 401K (even if you don't contribute). Also, 100% company-paid life insurance (up to $300K) and long-term disability insurances.
• Professional Development: $1500 Professional Development Budget (per year)
• Team Meals: MatX provides onsite team lunch & dinner Monday - Friday, with your choice of ordering via WeBox, Specialty’s or via our reimbursement system
• Commute on Us: Commute on our company Uber account, or reimburse your train rides. Either way, we pay 100% for your daily commute.
• MatX E[x]tras: $50/mo to use on the perk you value most
• Cell & Internet Reimbursement: $35/mo for cellular and $40/mo for wifi
• Mental Wellbeing: 100% paid mental health benefit via SpringHealth and Guardian EAP.
• Support to Parents: Up to 12 weeks paid parental leave regardless of path to parenthood, 10 weeks pregnancy disability leave, flexible return-to-work hours, and Benepass reproductive health & parental benefit.

As part of our dedication to the diversity of our team and our focus on creating an inviting and inclusive work experience, MatX is committed to a policy of Equal Employment Opportunity and will not discriminate against an applicant or employee on the basis of race, color, religion, creed, national origin or ancestry, sex, gender, gender identity, gender expression, sexual orientation, age, physical or mental disability, medical condition, marital/domestic partner status, military and veteran status, genetic information or any other legally recognized protected basis under federal, state or local laws, regulations or ordinances.

This position requires access to information that is subject to U.S. export controls. This offer of employment is contingent upon the applicant's capacity to perform job functions in compliance with U.S. export control laws without obtaining a license from U.S. export control authorities.