Software Engineer, Security

Keycard Labs

. Write, review, and maintain production code in the token service, policy engine, and gateway .

Posted 10/27/2026full-timeRemote • United States, CanadaMid-LevelSeniorWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in securing identity systems and applications, with a strong focus on vulnerability assessment, risk management, and cloud security practices. Proficient in production code maintenance and shipping, with a solid understanding of OAuth standards and identity infrastructure.

Highest-signal resume keywords

Staff-Level Software Engineering ExperienceProduction Code Shipping and MaintenanceVulnerability Assessment and RemediationOAuth 2.0 and 2.1 KnowledgeAWS Security Experience

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Production Code MaintenanceVulnerability Finding and FixingOAuth 2.0OIDCToken ExchangeIAM Policy IdentificationCloud Audit Log AnalysisSecurity Tool DevelopmentCI Regression TestingRisk Management

Soft Skills

Good Judgment About RiskAbility to Explain Attack Paths

Tools & Technologies

AWSCedarDPoPSPIFFESPIREMCP GatewayCLISDKsConsoleToken Service

Industry Keywords

Identity InfrastructureMulti-Tenant SaaSSecurity ReviewsPentestsCloud GuardrailsDependency Risk ManagementSecurity RoadmapIncident RolesTrust BoundariesAuthorization Failures

Tech Stack

Tools & technologies

AWSCloud

About the role

Key responsibilities & impact

Write, review, and maintain production code in the token service, policy engine, and gateway
Threat-model agent access through token exchange, delegation, per-tool checks, and the MCP gateway
Investigate confused deputies, poisoned tool descriptions, prompt injection, issuer and audience mix-ups, and token passthrough
Ensure credentials do not leak between hops and delegated access ends when expired or revoked
Analyze the capabilities of compromised agents and prevent privilege escalation or cross-tenant access
Review designs and code across the token service, Cedar policy engine, MCP gateway, CLI, SDKs, and Console
Run scoped agents against isolated instances and investigate authorization failures
Convert confirmed failures into CI regressions for token exchange, impersonation, and per-tool policy
Serve as technical voice during customer security reviews and pentests
Establish cloud guardrails for cloud accounts, pipelines, and customer-hosted cells
Design service identity and PKI, sign customer-shipped software, and manage dependency risk
Keep internal credentials short-lived and narrowly scoped
Investigate vulnerabilities and security events, coordinate fixes, improve detection, and define security on-call processes
Map trust boundaries and priority delegation flows during the first month
Ship prioritized fixes with CI regressions
Build customer-review evidence and pentest-finding triage processes
Own the risk register and create a product and company security roadmap with owners and incident roles by day 90

Requirements

What you’ll need

Staff-level software engineering experience
Production code shipping and maintenance experience
Experience finding and fixing vulnerabilities in applications or identity systems
Ability to read unfamiliar code, build exploits or reproductions, and ship fixes with regression tests
Knowledge of OAuth 2.0 and 2.1, OIDC, and token exchange (RFC 8693)
Ability to identify issues in IAM policies, network paths, and cloud audit logs
Good judgment about risk and ability to explain and size attack paths and agree on fixes
Experience using agents for review, triage, or testing, with ability to check their output and limit access
Experience in identity infrastructure, developer tools, or multi-tenant SaaS is advantageous
Experience with DPoP, Cedar, or SPIFFE/SPIRE is advantageous
Hands-on AWS security experience with IAM, SCPs, logging, and infrastructure as code is advantageous
Experience securing agents or MCP servers, including tool permissions and sandboxing, is advantageous
Experience building security tools adopted by engineers is advantageous
Public security work such as CVEs, bug bounties, write-ups, or OAuth and MCP standards work is advantageous
Ability to work in the United States or Canada, based on the required authorization question

Benefits

Comp & perks

Generous equity package with 4-year vest and 1-year cliff
Health, dental, vision, and paramedical coverage for you and your family
4 weeks vacation
11 statutory holidays
1 volunteer day annually
Encouragement to take at least 2 weeks off each year to recharge
New MacBook Pro
$500 stipend for peripherals
Best AI tools available
Remote-first flexibility
Asynchronous collaboration
Huge autonomy and opportunity to gain mastery
Global team accountability and agent-native work environment