At Keycard, we’re building identity and access infrastructure for the agent-native era, where software isn't static but a dynamic, constantly changing system of AI agents working on behalf of people and businesses. Keycard gives every agent a verified identity and issues short-lived, task-scoped credentials at runtime, so agents can only do what they were asked to do, and every action is fully auditable.
We’re backed by a16z, Boldstart, and Acrew, and our founding team built and scaled Snyk, Auth0, Hashi Corp, and Heroku.
We’re hiring a staff-level Software Engineer, Security. This is a software engineering role: you’ll build and run the security program for what Keycard ships and runs, across our product, our infrastructure, and what we publish, mostly as code and automation. Security is everyone's job here. You’d be the first engineer whose whole job is security, working with engineers who already know the field.
It matters because security is what we sell: a hole in our token exchange or policy checks hands a customer's agent access nobody granted. You find those holes early and build the tooling that catches the next ones.
Keycard is a control plane for agents: identity, credential exchange, delegation, policy, and audit. It has to hold even when the agent itself is compromised. Agents are part of how we build, and part of how you'll do this job.
You'll also secure Keycard itself: our cloud accounts, customer-hosted deployments, our pipeline, and secrets. You set the controls and run security response. Platform engineering runs the infrastructure; operations handles audits and customer reviews. You prioritize product and company security work by risk to customers and Keycard.
What You'll Do Secure the productThreat modeling. Trace how an agent gets access, from token exchange through delegation to the per-tool check at our MCP gateway, then attack it: confused deputies, poisoned tool descriptions, prompt injection, issuer and audience mix-ups, token passthrough. Credentials shouldn't leak between hops, and delegated access should end when it expires or is revoked.
Assume compromise. Even a compromised agent should be stopped from escalating privileges or crossing tenants. Document what it can still do with its access.
Design review. Review designs and code across the token service, Cedar policy engine, MCP gateway, CLI, SDKs, and Console, mostly for who can do what and whether zones stay isolated.
Attack with agents. Run scoped agents against an isolated instance and chase the authorization failures they find. Confirmed failures become CI regressions for token exchange, impersonation, or per-tool policy. Example: a harness that follows a delegated credential end to end and checks it never gains scope or lifetime.
Customer reviews. Be the technical voice when customers' security teams review or pentest us; operations runs the process.
Cloud and delivery controls. Build agents that find and fix misconfigurations in cloud accounts, pipelines, and published artifacts, with scoped access and human review for their changes. With platform engineering, test isolation between deployments and audited break-glass access.
Our own credentials. Keep them short-lived and narrow. Design service identity and PKI, sign what we ship to customers, and manage dependency risk. You also use Keycard to scope what our own agents can reach.
Incident response. Investigate vulnerabilities and security events, coordinate fixes, and automate detection and routine fixes where you can. You'll also work out with engineering how on-call works for security.
You've shipped and maintained production code, not only security tooling, and you've found and fixed…
(If this job is in fact in your jurisdiction, then you may be using a Proxy or VPN to access this site, and to progress further, you should change your connectivity to another mobile device or PC).