{"id":3301418,"url":"https://alion.io/job/keycard-software-engineer-security","title":"Software Engineer, Security","company":{"id":41879,"name":"Keycard","domain":"keycard.ai","url":"https://alion.io/company/keycard","size_band":"51-200","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Ashby","truth_index":null},"role":"Backend","role_family":"Backend","seniority":null,"employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"posting_text","remote_working_hours":null,"hiring_geo_confidence":"inferred","locations":[],"countries":[],"hiring_countries":["US","CA"],"hiring_countries_total":2,"salary":null,"salary_estimate":{"min_usd":123000,"max_usd":265000,"period":"year","method":"role_country_seniority_unknown","sample_n":9411},"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":true,"technologies":[{"name":"AI Agents","optional":false},{"name":"Auth0","optional":false},{"name":"AWS","optional":false},{"name":"Heroku","optional":false},{"name":"IAM","optional":false},{"name":"Model Context Protocol","optional":false},{"name":"PKI","optional":false},{"name":"Platform Engineering","optional":false},{"name":"Red Teaming","optional":false},{"name":"Snyk","optional":false},{"name":"Threat Modeling","optional":false}],"status":"live","first_seen_at":"2026-10-26T21:34:44Z","employer_posted_date":"2026-10-26","last_verified_at":"2026-10-28T16:31:04Z","board_verified":true,"closed_at":null,"days_open":1,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":1},"description":"About Keycard\nAt Keycard, we're building identity and access infrastructure for the agent-native era, where software isn't static but a dynamic, constantly changing system of AI agents working on behalf of people and businesses. Keycard gives every agent a verified identity and issues short-lived, task-scoped credentials at runtime, so agents can only do what they were asked to do, and every action is fully auditable. We're backed by a16z, Boldstart, and Acrew, and our founding team built and scaled Snyk, Auth0, HashiCorp, and Heroku.\nThe Role\nWe're hiring a staff-level Software Engineer, Security. This is a software engineering job: you'll write, review, and maintain production code in our token service, policy engine, and gateway. You'd be the first engineer whose whole job is security, working with engineers who already know the field. A full-time security seat matters because security is what we sell: a hole in our token exchange or policy checks hands a customer's agent access nobody granted. You find those holes first and fix them with the team.\nKeycard is a control plane for agents: identity, credential exchange, delegation, policy, and audit. It has to hold even when the agent itself is compromised. Agents are part of how we build, and part of how you'll do this job.\nYou'll also secure Keycard itself: our cloud accounts, the cells we run in customers' accounts, our pipeline, and secrets. You set the controls and lead security response. Platform engineering runs the infrastructure; operations handles audits and customer reviews. When the two jobs compete, product security wins.\nWhat You'll Do\nSecure the product\nThreat modeling. Trace how an agent gets access, from token exchange through delegation to the per-tool check at our MCP gateway, then attack it: confused deputies, poisoned tool descriptions, prompt injection, issuer and audience mix-ups, token passthrough. Credentials shouldn't leak between hops, and delegated access should end when it expires or is revoked.\n\nAssume compromise. Even a compromised agent should be stopped from escalating privileges or crossing tenants. Document what it can still do with its access.\n\nDesign review. Review designs and code across the token service, Cedar policy engine, MCP gateway, CLI, SDKs, and Console, mostly for who can do what and whether zones stay isolated.\n\nAttack with agents. Run scoped agents against an isolated instance and chase the authorization failures they find. Confirmed failures become CI regressions for token exchange, impersonation, or per-tool policy. Example: a harness that follows a delegated credential end to end and checks it never gains scope or lifetime.\n\nCustomer reviews. Be the technical voice when customers' security teams review or pentest us; operations runs the process.\n\nSecure Keycard\nCloud guardrails. Set the rules for our cloud accounts, pipeline, and customer-hosted cells, down to cell isolation and audited break-glass access. Platform engineering builds them.\n\nOur own credentials. Keep them short-lived and narrow. Design service identity and PKI, sign what we ship to customers, and manage dependency risk. You also use Keycard to scope what our own agents can reach.\n\nIncident response. Investigate vulnerabilities and security events, coordinate fixes, and improve detection. You'll also work out with engineering how on-call works for security.\n\nWhat We're Looking For\nYou've shipped and maintained production code, not only security tooling, and you've found and fixed vulnerabilities in applications or identity systems.\n\nYou can read unfamiliar code, build an exploit or reproduction, and ship the fix with a regression test.\n\nYou know OAuth 2.0 and 2.1, OIDC, and token exchange (RFC 8693), and can describe failures you've seen, like refresh-token misuse.\n\nYou can spot the problem in an IAM policy, a network path, or a cloud audit log, even if you've never run cloud infrastructure.\n\nGood judgment about risk. You can explain an attack path, size it, and agree on a fix with the team.\n\nAgents at work. You use agents for review, triage, or testing, and know how to check their output and limit their access.\n\nStrong Candidates May Also Have\nExperience in identity infrastructure, developer tools, or multi-tenant SaaS.\n\nExperience with DPoP, Cedar, or SPIFFE/SPIRE.\n\nHands-on AWS security: IAM, SCPs, logging, infrastructure as code.\n\nSecuring agents or MCP servers, including tool permissions and sandboxing.\n\nA security tool you built that engineers adopted and that ended a class of bugs.\n\nPublic security work: CVEs, bug bounties, write-ups, or OAuth and MCP standards work.\n\nYour First 90 Days\nMonth one: map trust boundaries in token exchange and one priority delegation flow, attack them, and compare findings with our risk register. Review the company security setup with platform engineering.\n\nShip fixes for the findings we agree matter most, each with a CI regression.\n\nBuild reusable evidence for customer reviews and a triage process for pentest findings; questionnaires stay with operations.\n\nBy day 90: a product and company security roadmap with owners and incident roles, built from the risk register you now own.\n\nWho Will Love This Job\nYou'd rather break the product yourself than wait for a customer's red team to.\n\nYou'd rather fix a class of bugs once than file the same finding twice.\n\nWhat We Offer\nBuild at the Frontier: Work every day at the frontier of agent-native systems - shipping, inventing, and iterating on technology that hasn’t been built before. You’ll be given huge autonomy, the opportunity to gain mastery, and the chance to work in a team that holds each other accountable to succeed.\n\nTruly Agent-Native Culture: At Keycard, we don’t just enable others to adopt agents - we use them ourselves to build. You’ll help shape an organization that embeds AI into its foundation as an enduring competitive advantage.\n\nCompensation With Upside: Market-competitive salaries and generous equity packages (4-year vest, 1-year cliff) give you the security to focus on building - and the asymmetric upside of ownership in a company chasing a category-defining mission.\n\nComprehensive Benefits & Recharge: Health, dental, vision, and paramedical coverage for you and your family, plus 4 weeks vacation, 11 statutory holidays, and 1 volunteer day annually. We encourage at least 2 weeks off each year to fully recharge.\n\nTools That Keep You Ahead: A new MacBook Pro, a $500 stipend for peripherals, and the best AI tools available so you can work at the forefront of agent-native workflows.\n\nRemote-First Flexibility: We are a remote-first team prioritizing asynchronous collaboration, with hiring focused in North and South America. Work where you’re strongest - we just want the best.","description_format":"text","description_chars":6761,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Apple Macbook","Equity"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"},{"name":"Canada","iso":"CA","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Artificial Intelligence","Identity Management","Information Security","AI Agents"],"lifecycle":[{"event":"open","at":"2026-10-26T23:48:57Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":1,"expected_fill_days":159,"reasons":["conf:3","win:early"],"computed_at":"2026-10-28T05:59:10Z"},"pay":null,"html_url":"https://alion.io/job/keycard-software-engineer-security","json_url":"https://alion.io/job/keycard-software-engineer-security.json","meta":{"generated_at":"2026-10-28T18:49:02Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":25726,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-29T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":41879},"rest":"https://alion.io/mcp/rest/get_company?id=41879"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fkeycard-software-engineer-security"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fkeycard-software-engineer-security"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fkeycard-software-engineer-security"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/keycard-software-engineer-security\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fkeycard-software-engineer-security"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3301418}},{"tool":"search_jobs","arguments":{"company":"keycard.ai","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3301418},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}