2 months ago
Remote, United States or New York, NY, USASenior
Responsibilities
- Build and improve static and dynamic Watch scanning for MCP servers, skills, plugins, and agent behavior on endpoints.
- Develop shadow detection for unregistered MCP servers, skills, plugins, and agents operating outside enterprise governance.
- Build automated version scanning and security checks for new MCP server versions, skill updates, and plugin releases.
- Extend detection coverage to CLI agents including Codex and OpenCode and to browser-based agents.
- Own security detection products end to end from threat modeling through shipped features, including AppSec for the platform.
Requirements
- At least 8 years of engineering experience in security, including building security tooling or endpoint detection products.
- Demonstrated experience creating scanning or detection systems such as parsers, rule engines, or analysis pipelines.
- Experience with shadow IT detection, asset discovery, or endpoint monitoring in enterprise environments.
- Strong Python skills and experience with Python/FastAPI scanning or backend systems.
- Understanding of API and gateway attack patterns including SSRF, token theft, injection, and supply-chain attacks.
- Awareness of AI/LLM security threats including prompt injection, tool poisoning, jailbreaking, and indirect prompt injection through tool responses.
- Experience with MCP, AI agents, or LLM security is a bonus.
- Commercial security product experience and an enterprise security network are bonus qualifications.
Benefits
- Competitive salary and equity package.
- Paid vacation, sick leave, and parental leave.
- Professional development budget for conferences, courses, and certifications.
- Choice of laptop and accessories.
- Comprehensive health, dental, and vision coverage.
- Opportunities to interact directly with enterprise customers.
- Founding-team role with end-to-end ownership and impact on enterprise AI security.
About Runlayer
Give every employee the golden path to use agents, then watch adoption multiply. AI enablement and control in one platform. The default for AI-native teams like Instacart, Gusto, Lemonade, dbt Labs, and AngelList. Backed by Khosla and Felicis. Based in NYC & SF.