Software Engineer, Security
Core
Design, build, and secure token services, policy engines, and gateways for multi-tenant SaaS, focusing on threat modeling, authorization, and credential lifetimes.
Role type
Senior Security Software Engineer (Identity & Tokenization)
Builds
Production token services, policy engines, MCP gateways, and security controls for customer cells.
Domain
Cloud Security, Identity & Access Management (IAM), Token Security
Required skills
Production software engineering, vulnerability analysis, OAuth 2.0/2.1, OIDC, RFC 8693, IAM policy analysis, cloud audit log analysis, risk assessment, exploit development, agent security review
Preferred skills
Identity infrastructure, multi-tenant SaaS, DPoP, Cedar, SPIFFE/SPIRE, AWS security, IAM SCPs, infrastructure as code, agent/MCP security, sandboxing, CVEs, bug bounties
Technologies
Cedar, MCP, OAuth, OIDC, AWS, PKI, SPIFFE, SPIRE
Responsibilities
Write, review, and maintain production code in token services and policy engines; Threat-model token exchange, delegation, and agent access; Review designs and code across Cedar policy engine, MCP gateway, CLI, SDKs, and Console; Attack isolated instances with scoped agents and turn confirmed authorization failures into CI regressions; Support customer security reviews and pentests; Set cloud, pipeline, customer-cell, credential, service-identity, PKI, and break-glass security controls; Investigate vulnerabilities and security events, coordinate fixes, and improve detection; Own the security risk register and develop a product and company security roadmap.
Seniority
Senior, hands-on IC
