Member of Technical Staff - Security

Runlayer; San Francisco (CA); On-site; USD 140,000 - 200,000; Full time

Benefits offered by this job

Competitive salary and equity

Paid time off

Professional development

Top-tier equipment

Health benefits

Customer interaction opportunities

Job summary

Runlayer is building enterprise-grade AI security tooling. We are seeking a security engineer to join our founding team and own the Runlayer Watch products—static and dynamic scanning—protecting enterprise AI by detecting unregistered agents and enforcing governance.

You will own detection features end-to-end, from threat modeling to shipping features, collaborating with senior engineers from top cyber backgrounds and aligning with our security-first platform strategy.

Qualifications

• 8+ years of engineering experience in security tooling or endpoint detection.
• Built scanning or detection systems: parsers, rule engines, analysis pipelines.
• Experience with shadow IT detection, asset discovery, or endpoint monitoring in enterprise environments.
• Strong Python skills (Python/FastAPI).
• Understanding of API and gateway attack patterns: SSRF, token theft, injection, supply-chain attacks.
• Awareness of emerging AI/LLM security threats: prompt injection, tool poisoning, jailbreaking, indirect prompt injection through tool responses.

Responsibilities

• Build and improve Watch products: static and dynamic scanning for MCP servers, skills, plugins, and agent behavior detection on endpoints
• Develop shadow detection: identify unregistered MCP servers, skills, plugins, and agents running outside governance across the enterprise
• Build automated version scanning: CI/CD-integrated security checks that run on each new MCP server version, skill update, or plugin release
• Extend detection coverage to CLI agents (Codex, OpenCode) and browser-based agents

Skills

Python

FastAPI

Threat modeling

Endpoint detection

Scanning systems

Shadow IT detection

Parsers/Rule engines

CI/CD security checks

Tools

FastAPI

Security tooling

Job description

About Runlayer

AI is transforming how every company operates, but most enterprises are stuck. They want to move fast with AI Agents, tools, and workflows, but they can’t do it safely. We’re fixing that.

About Runlayer

AI is transforming how every company operates, but most enterprises are stuck. They want to move fast with AI Agents, tools, and workflows, but they can’t do it safely. We’re fixing that. Our team built AI Actions for OpenAI, shipped Zapier Agents to millions of users, and launched the first remote MCP server with Anthropic. We helped establish the protocol, and now we’re building the platform enterprises need to actually put AI to work. Runlayer is one platform for MCPs, Skills, and Agents: purpose-built security, fine-grained governance, and complete observability so organizations can go all-in on AI across the entire company without the risk. We just raised a $30M Series A led by Felicis, with participation from Khosla Ventures, bringing our total raised to $42M. Already trusted by Gusto, Instacart, Opendoor, dbt Labs, and Decagon.

About The Role

Looking for a security engineer, to join our small founding team, you’ll build the security scanning and detection products that protect enterprise AI. You own the Runlayer Watch products (static and dynamic scanning), shadow detection of unregistered agents and servers, and AppSec for the platform itself.

Why You’ll Thrive Here

• Impact: Build the security layer for the AI agent infrastructure category, directly shaping how enterprises adopt AI safely
• Excellence: Work alongside founders from Zapier's AI team and a team of senior engineers from top cyber backgrounds
• Ownership: Own detection products end-to-end, from threat modeling through shipped features

What You’ll Do

• Build and improve Watch products: static and dynamic scanning for MCP servers, skills, plugins, and agent behavior detection on endpoints
• Develop shadow detection: identify unregistered MCP servers, skills, plugins, and agents running outside governance across the enterprise
• Build automated version scanning: CI/CD-integrated security checks that run on each new MCP server version, skill update, or plugin release
• Extend detection coverage to CLI agents (Codex, OpenCode) and browser-based agents

What We’re Looking For

• 8+ years of engineering experience in the Security space, building Security tooling or endpoint detection products.
• Builder, not operator. You’ve created scanning or detection systems: parsers, rule engines, analysis pipelines.
• Experience with shadow IT detection, asset discovery, or endpoint monitoring in enterprise environments
• Strong Python skills (our scanning pipeline and platform backend are Python/FastAPI)
• Understanding of API and gateway attack patterns: SSRF, token theft, injection, supply-chain attacks
• Awareness of emerging AI/LLM security threats: prompt injection, tool poisoning, jailbreaking, indirect prompt injection through tool responses

Bonus Qualifications

• Experience with MCP, AI agents, or LLM security specifically
• Background in building commercial security products (not just internal tooling)
• Network in enterprise security (SVCI, Israeli security community, etc.)

What We Offer

We provide a competitive package designed to attract and retain top talent who can work effectively with enterprise customers.

• Competitive salary and equity — compensation that reflects your expertise and customer-facing responsibilities.
• Paid time off — paid vacation, paid sick leave, and paid parental leave.
• Professional development — budget for conferences, courses, and certifications in AI, enterprise software, and customer success.
• Top-tier equipment — your choice of laptop and accessories to create your ideal work environment.
• Health benefits — comprehensive health, dental, and vision coverage.
• Customer interaction opportunities — work directly with innovative companies and see the immediate impact of your work.