Software Engineer, Security

The role

You will build and run the security program for Keycard's product, infrastructure, and published code using automation. You will perform threat modeling, design reviews, and incident response to secure the identity and access infrastructure.

What you will do

• Perform threat modeling on agent access and token exchange
• Assume compromise to document potential privilege escalation
• Conduct design reviews for token service, Cedar policy engine, MCP gateway, CLI, SDKs, and Console
• Run scoped agents against isolated instances to find authorization failures
• Build agents to find and fix misconfigurations in cloud accounts and pipelines
• Design service identity and PKI
• Manage dependency risk
• Investigate vulnerabilities and security events
• Coordinate fixes and automate detection
• Work with engineering on security on-call

Required qualifications

• Shipped and maintained production code
• Found and fixed vulnerabilities in applications or identity systems
• Can read unfamiliar code, build an exploit or reproduction, and ship the fix with a regression test
• Know OAuth 2.0 and 2.1, OIDC, and token exchange (RFC 8693)
• Can spot problems in an IAM policy, a network path, or a cloud audit log
• Built security tooling other engineers adopted
• Use agents for review, triage, or testing and know how to check their output and limit their access

Nice to have

• Experience in identity infrastructure, developer tools, or multi-tenant SaaS
• Experience with DPoP, Cedar, or SPIFFE/SPIRE
• Hands-on AWS security: IAM, SCPs, logging, infrastructure as code
• Securing agents or MCP servers, including tool permissions and sandboxing
• Public security work: CVEs, bug bounties, write-ups, or OAuth and MCP standards work

Benefits

• Market-competitive salaries
• Generous equity packages (4-year vest, 1-year cliff)
• Health, dental, vision, and paramedical coverage for you and your family
• 4 weeks vacation
• 11 statutory holidays
• 1 volunteer day annually
• New MacBook Pro
• $500 stipend for peripherals
• Best AI tools available

About the company

Keycard is building identity and access infrastructure for the agent-native era. The founding team built and scaled Snyk, Auth0, HashiCorp, and Heroku.