Software Engineer, Security

Role overview

Build and run the security engineering program for a software platform that manages identity, delegated access, and credentials for AI agents. The work spans product security and the organization’s own cloud environments, delivery pipeline, and secrets, with an emphasis on finding weaknesses early and turning fixes into repeatable controls and automation.

Responsibilities

- Threat-model and test agent authorization flows, including token exchange, delegation, policy checks, and tool access. - Review designs and code across identity services, policy enforcement, gateways, command-line tools, SDKs, and the web console. - Assess what a compromised agent could access, and prevent privilege escalation or access across customer boundaries. - Build security automation for cloud accounts, pipelines, and published artifacts, with carefully scoped permissions and human review. - Improve service identity, short-lived credentials, signing, dependency management, and isolation between deployments. - Investigate security events, coordinate fixes, and establish detection, response, and incident roles with engineering.

Requirements

- Production software engineering experience and a record of finding and fixing vulnerabilities in applications or identity systems. - Ability to understand unfamiliar code, reproduce or exploit a weakness, and deliver a fix with a regression test. - Knowledge of OAuth 2.0/2.1, OIDC, and token exchange, including common failure modes. - Ability to assess IAM policies, network paths, and cloud audit logs. - Experience building security tools adopted by engineers, and explaining their coverage, limitations, and review needs. - Practical use of coding agents for review, triage, or testing, with the ability to verify results and limit access.

Nice to have

- Background in identity infrastructure, developer tools, or multi-tenant SaaS. - Experience with DPoP, Cedar, SPIFFE/SPIRE, AWS security, infrastructure as code, or agent and MCP security. - Public security contributions such as vulnerability disclosures, bug bounties, or standards work.

Benefits and work setup

Remote-first and asynchronous, with hiring focused in North and South America. Benefits include health, dental, vision, and paramedical coverage; four weeks of vacation; statutory holidays; and a volunteer day. A computer and peripherals stipend are provided.