Software Engineer, Security

Job not on LinkedIn

🔥 2 minutes ago

🌐 United States, Canada – Remote

🇺🇸 United States – Remote 🇨🇦 Canada – Remote

⏰ Full Time

🟡 Mid-level

🟠 Senior

👮‍♂️ Cybersecurity / Security Engineer

👻 Ghost score 17%

What it means: how likely this posting is sitting open without active hiring.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

Keycard Labs

WebsiteLinkedInAll Job Openings

1 - 10 employees

Founded 2025

💼 Consulting

📣 Marketing

🤖 Artificial Intelligence

Consulting • Marketing • Artificial Intelligence

Keycard Labs is a company that specializes in creating a unified identity infrastructure for agents, tools, and applications. They provide solutions that enhance agent security and control through dynamic, task-scoped access tokens, allowing developers to build trusted AI experiences while ensuring compliance and visibility. With a focus on eliminating secret sprawl, Keycard Labs enables organizations to delegate access securely and efficiently, supporting the development of autonomous agents in a compliant manner.

📋 Description

• Write, review, and maintain production code in the token service, policy engine, and gateway • Threat-model agent access through token exchange, delegation, per-tool checks, and the MCP gateway • Investigate confused deputies, poisoned tool descriptions, prompt injection, issuer and audience mix-ups, and token passthrough • Ensure credentials do not leak between hops and delegated access ends when expired or revoked • Analyze the capabilities of compromised agents and prevent privilege escalation or cross-tenant access • Review designs and code across the token service, Cedar policy engine, MCP gateway, CLI, SDKs, and Console • Run scoped agents against isolated instances and investigate authorization failures • Convert confirmed failures into CI regressions for token exchange, impersonation, and per-tool policy • Serve as technical voice during customer security reviews and pentests • Establish cloud guardrails for cloud accounts, pipelines, and customer-hosted cells • Design service identity and PKI, sign customer-shipped software, and manage dependency risk • Keep internal credentials short-lived and narrowly scoped • Investigate vulnerabilities and security events, coordinate fixes, improve detection, and define security on-call processes • Map trust boundaries and priority delegation flows during the first month • Ship prioritized fixes with CI regressions • Build customer-review evidence and pentest-finding triage processes • Own the risk register and create a product and company security roadmap with owners and incident roles by day 90

🎯 Requirements

• Staff-level software engineering experience • Production code shipping and maintenance experience • Experience finding and fixing vulnerabilities in applications or identity systems • Ability to read unfamiliar code, build exploits or reproductions, and ship fixes with regression tests • Knowledge of OAuth 2.0 and 2.1, OIDC, and token exchange (RFC 8693) • Ability to identify issues in IAM policies, network paths, and cloud audit logs • Good judgment about risk and ability to explain and size attack paths and agree on fixes • Experience using agents for review, triage, or testing, with ability to check their output and limit access • Experience in identity infrastructure, developer tools, or multi-tenant SaaS is advantageous • Experience with DPoP, Cedar, or SPIFFE/SPIRE is advantageous • Hands-on AWS security experience with IAM, SCPs, logging, and infrastructure as code is advantageous • Experience securing agents or MCP servers, including tool permissions and sandboxing, is advantageous • Experience building security tools adopted by engineers is advantageous • Public security work such as CVEs, bug bounties, write-ups, or OAuth and MCP standards work is advantageous • Ability to work in the United States or Canada, based on the required authorization question

🏖️ Benefits

• Generous equity package with 4-year vest and 1-year cliff • Health, dental, vision, and paramedical coverage for you and your family • 4 weeks vacation • 11 statutory holidays • 1 volunteer day annually • Encouragement to take at least 2 weeks off each year to recharge • New MacBook Pro • $500 stipend for peripherals • Best AI tools available • Remote-first flexibility • Asynchronous collaboration • Huge autonomy and opportunity to gain mastery • Global team accountability and agent-native work environment