Software Engineer, Security
Keycard Labs10 hours ago
Remote, United States or Remote, CanadaStaff+
Responsibilities
- Write, review, and maintain production code in the token service, policy engine, and gateway.
- Threat-model token exchange, delegation, agent access, MCP gateway authorization, tenant isolation, and credential lifetimes.
- Review designs and code across the Cedar policy engine, MCP gateway, CLI, SDKs, and Console.
- Attack isolated instances with scoped agents and turn confirmed authorization failures into CI regressions.
- Support customer security reviews and pentests as the technical security representative.
- Set cloud, pipeline, customer-cell, credential, service-identity, PKI, and break-glass security controls.
- Investigate vulnerabilities and security events, coordinate fixes, improve detection, and help establish security on-call procedures.
- Own the security risk register and develop a product and company security roadmap with owners and incident roles.
Requirements
- Production software engineering experience, including shipping and maintaining code rather than only security tooling.
- Experience finding and fixing vulnerabilities in applications or identity systems.
- Ability to read unfamiliar code, build exploits or reproductions, and ship fixes with regression tests.
- Knowledge of OAuth 2.0, OAuth 2.1, OIDC, RFC 8693 token exchange, and common token-security failures such as refresh-token misuse.
- Ability to analyze IAM policies, network paths, and cloud audit logs.
- Strong risk judgment and ability to explain attack paths, size risk, and agree on fixes with engineering.
- Experience using agents for review, triage, or testing while checking their output and limiting their access.
- Preferred experience with identity infrastructure, developer tools, multi-tenant SaaS, DPoP, Cedar, SPIFFE/SPIRE, AWS security, IAM, SCPs, logging, infrastructure as code, agent or MCP security, sandboxing, public security work, CVEs, bug bounties, or OAuth and MCP standards.
Benefits
- Remote-first work with asynchronous collaboration and hiring focused in North and South America.
- Market-competitive salary and generous equity with a four-year vesting schedule and one-year cliff.
- Health, dental, vision, and paramedical coverage for employees and families.
- Four weeks of vacation, 11 statutory holidays, and one volunteer day annually.
- New MacBook Pro, $500 peripherals stipend, and access to AI tools.
- High autonomy, frontier agent-native work, and opportunities for mastery and ownership.
About Keycard Labs
Keycard is on a mission to redefine machine identity for the Internet—helping developers seamlessly connect people, agents, and services across networks, clouds, and applications. As AI-driven workflows grow more complex, Keycard’s dynamic, identity-based credentials ensure every agent and service operates with precise, contextual permissions. We’re building a global identity network backed by open protocols—empowering distributed systems to adapt, scale, and maintain cryptographically verifiable trust. By rethinking secret management from first principles, we aim to delight developers, meet the performance needs of platform engineers, and set a new standard for cloud-era security in an inclusive, collaborative environment.