Product Security Engineer building secure CIAM authentication services for Affirm’s pay - over - time platform. Developing Python/Kotlin APIs, MFA, identity integrations, and reliable account - access experiences.
About the role
- Staff Security Software Engineer securing Keycard’s agent identity and access infrastructure. Threat-modeling token exchange, delegation, cloud controls, and AI-agent authorization.
Responsibilities
- Write, review, and maintain production code in the token service, policy engine, and gateway
- Threat-model agent access through token exchange, delegation, per-tool checks, and the MCP gateway
- Investigate confused deputies, poisoned tool descriptions, prompt injection, issuer and audience mix-ups, and token passthrough
- Ensure credentials do not leak between hops and delegated access ends when expired or revoked
- Analyze the capabilities of compromised agents and prevent privilege escalation or cross-tenant access
- Review designs and code across the token service, Cedar policy engine, MCP gateway, CLI, SDKs, and Console
- Run scoped agents against isolated instances and investigate authorization failures
- Convert confirmed failures into CI regressions for token exchange, impersonation, and per-tool policy
- Serve as technical voice during customer security reviews and pentests
- Establish cloud guardrails for cloud accounts, pipelines, and customer-hosted cells
- Design service identity and PKI, sign customer-shipped software, and manage dependency risk
- Keep internal credentials short-lived and narrowly scoped
- Investigate vulnerabilities and security events, coordinate fixes, improve detection, and define security on-call processes
- Map trust boundaries and priority delegation flows during the first month
- Ship prioritized fixes with CI regressions
- Build customer-review evidence and pentest-finding triage processes
- Own the risk register and create a product and company security roadmap with owners and incident roles by day 90
Requirements
- Staff-level software engineering experience
- Production code shipping and maintenance experience
- Experience finding and fixing vulnerabilities in applications or identity systems
- Ability to read unfamiliar code, build exploits or reproductions, and ship fixes with regression tests
- Knowledge of OAuth 2.0 and 2.1, OIDC, and token exchange (RFC 8693)
- Ability to identify issues in IAM policies, network paths, and cloud audit logs
- Good judgment about risk and ability to explain and size attack paths and agree on fixes
- Experience using agents for review, triage, or testing, with ability to check their output and limit access
- Experience in identity infrastructure, developer tools, or multi-tenant SaaS is advantageous
- Experience with DPoP, Cedar, or SPIFFE/SPIRE is advantageous
- Hands-on AWS security experience with IAM, SCPs, logging, and infrastructure as code is advantageous
- Experience securing agents or MCP servers, including tool permissions and sandboxing, is advantageous
- Experience building security tools adopted by engineers is advantageous
- Public security work such as CVEs, bug bounties, write-ups, or OAuth and MCP standards work is advantageous
- Ability to work in the United States or Canada, based on the required authorization question
Benefits
- Generous equity package with 4-year vest and 1-year cliff
- Health, dental, vision, and paramedical coverage for you and your family
- 4 weeks vacation
- 11 statutory holidays
- 1 volunteer day annually
- Encouragement to take at least 2 weeks off each year to recharge
- New MacBook Pro
- $500 stipend for peripherals
- Best AI tools available
- Remote-first flexibility
- Asynchronous collaboration
- Huge autonomy and opportunity to gain mastery
- Global team accountability and agent-native work environment
Job title
Job type
Experience level
Salary
Not specified
Degree requirement
No Education Requirement
Tech skills
Location requirements
Report this job
Found something wrong with the page? Please let us know by submitting a report below.
Senior Security Consultant leading integrated security system design and project delivery. Advising Canadian commercial, institutional, and government building clients.
Global cybersecurity leader defining strategy, risk governance, and security operations for Innocap’s managed alternative - investment platform. Leading worldwide teams and protecting regulated financial technology.
Senior AI security specialist strengthening governance, architecture, and risk controls at TD, a global financial institution. Advising executives and technology teams on secure AI adoption.
Principal Product Security Researcher leading threat research and security strategy at Chainguard, a provider of hardened open - source software builds. Influencing product roadmaps and industry security practices.
Principal Product Security Researcher leading threat research and product security strategy. Shaping secure, production - ready open - source software builds for Chainguard customers.
Principal Product Security Researcher shaping threat research and security strategy for Chainguard’s hardened open - source software. Influencing product roadmaps, mitigating supply - chain risks, and advancing industry security practices.
Endpoint security engineer designing and operating enterprise protection for TD, a major North American bank. Leading security platforms, technical initiatives, and a small engineering team.
Hybrid offensive and defensive security advisor protecting Desjardins systems, networks, and applications. Investigating incidents, assessing vulnerabilities, and recommending mitigation measures.
Cybersecurity adjunct faculty teaching CSIA 300 asynchronously for University of Maryland Global Campus. Mentoring adult learners and supporting their academic and professional growth.