Software Engineer, Security

This is a fully remote position, open to applicants in United States, +1 more country.

📋 Description

• Write, review, and maintain production code for the token service, policy engine, and gateway.

• Conduct threat modeling for agent access through token exchange, delegation, per-tool checks, and the MCP gateway.

• Investigate issues such as confused deputies, poisoned tool descriptions, prompt injection, and mix-ups involving issuers and audiences, as well as token passthrough.

• Ensure that credentials do not leak between hops and that delegated access is terminated when expired or revoked.

• Analyze the capabilities of compromised agents to prevent privilege escalation or cross-tenant access.

• Review designs and code across the token service, Cedar policy engine, MCP gateway, CLI, SDKs, and Console.

• Execute scoped agents against isolated instances and investigate any authorization failures.

• Transform confirmed failures into CI regressions for token exchange, impersonation, and per-tool policies.

• Act as the technical representative during customer security reviews and penetration tests.

• Establish cloud guardrails for cloud accounts, pipelines, and customer-hosted cells.

• Design service identity and PKI, sign customer-delivered software, and manage dependency risks.

• Maintain short-lived and narrowly scoped internal credentials.

• Investigate vulnerabilities and security incidents, coordinate solutions, improve detection, and establish security on-call processes.

• Map trust boundaries and priority delegation flows within the first month.

• Deliver prioritized fixes alongside CI regressions.

• Develop evidence for customer reviews and processes for triaging pentest findings.

• Own the risk register and formulate a product and company security roadmap with defined owners and incident roles by day 90.

⛳️ Requirements

• Staff-level software engineering experience.

• Experience in shipping and maintaining production code.

• Proven ability to identify and remediate vulnerabilities in applications or identity systems.

• Capability to read unfamiliar code, create exploits or reproductions, and deliver fixes with regression tests.

• Knowledge of OAuth 2.0 and 2.1, OIDC, and token exchange (RFC 8693).

• Proficient in identifying issues within IAM policies, network paths, and cloud audit logs.

• Sound judgment regarding risk, with the ability to explain and assess attack paths and agree on solutions.

• Experience utilizing agents for review, triage, or testing, with the ability to validate their output and restrict access.

• Background in identity infrastructure, developer tools, or multi-tenant SaaS is a plus.

• Familiarity with DPoP, Cedar, or SPIFFE/SPIRE is advantageous.

• Hands-on experience in AWS security, including IAM, SCPs, logging, and infrastructure as code is a benefit.

• Experience securing agents or MCP servers, focusing on tool permissions and sandboxing, is beneficial.

• Proven experience in creating security tools that are widely adopted by engineers is a plus.

• Contributions to public security, including CVEs, bug bounties, write-ups, or work on OAuth and MCP standards, are advantageous.

• Eligibility to work in the United States or Canada based on the required authorization question.

🏝️ Benefits

• Generous equity package with a 4-year vesting schedule and a 1-year cliff.

• Comprehensive health, dental, vision, and paramedical coverage for you and your family.

• 4 weeks of vacation.

• 11 statutory holidays.

• 1 volunteer day each year.

• Encouragement to take a minimum of 2 weeks off annually to recharge.

• A new MacBook Pro.

• $500 stipend for peripherals.

• Access to the best AI tools available.

• Remote-first work flexibility.

• Asynchronous collaboration opportunities.

• Significant autonomy and the chance to achieve mastery in your role.

• A global team with accountability in an agent-native work environment.