Senior Security Architect – Biometric Identity

Xident; United States; Hybride; USD 140 000 - 230 000; Plein temps

Résumé du poste

Xident B.V. in the United States (remote-first) is seeking a Senior Security Engineer to protect our platform and biometric data. You will architect and enforce security across APIs, ML pipelines, and data in transit and at rest.

You will lead encryption, compliance programs (SOC 2, GDPR, CCPA, BIPA), and implement WebAuthn. The role combines hands-on security with influencing engineering culture in a fast-growing, globally distributed team.

Qualifications

• 7+ years of security engineering experience.
• Deep knowledge of app security, cryptography, and secure API design.
• Experience with security tools integrated into CI/CD pipelines.
• Understanding of SOC 2, GDPR, CCPA, and biometric data regulations.
• Hands-on WebAuthn/FIDO2 security model knowledge.
• Strong communication skills to drive security culture.

Responsabilités

• Lead security architecture reviews for new API endpoints, SDK features, and ML pipelines.
• Own encryption for data at rest (AES-256-GCM), TLS everywhere, and signed challenges.
• Conduct regular penetration testing, code audits, and dependency vulnerability assessments.
• Drive SOC 2, GDPR, and biometric data compliance initiatives.
• Implement WebAuthn/passkey security across dashboards and admin.
• Develop threat models for anti-spoofing, API abuse, and credential stuffing.

Connaissances

Security architecture

Application security

Cryptography

Secure API design

Security tooling

CI/CD security

Compliance frameworks

WebAuthn/FIDO2

Security communication

Outils

SAST

DAST

SCA

CI/CD security tooling

WebAuthn

Description du poste

As our Senior Security Engineer, you'll protect our platform and our users' biometric data. Xident processes face images, identity documents, and age verification results — our security posture must be exceptional. You'll build security into every layer, from AES-256-GCM encrypted embeddings to HMAC-signed challenges.

Xident is building the future of digital identity verification. Our platform enables businesses to verify users' ages and identities in seconds, while respecting privacy through our unique "Verify Once, Access Everywhere" model.

Founded in 2025, Xident is a remote-first company.

Our mission is simple: To make identity verification seamless, private, and accessible for everyone. We believe privacy and convenience shouldn't be mutually exclusive, and we're proving it every day.

What You'll Do

• Lead security architecture reviews for new API endpoints, SDK features, and ML pipelines
• Own encryption — AES-256-GCM for face embeddings at rest, TLS everywhere, HMAC-SHA256 signed challenges
• Conduct regular penetration testing, code audits, and dependency vulnerability assessments
• Drive SOC 2, GDPR, and biometric data compliance (BIPA, Illinois BIPA) initiatives
• Implement and maintain WebAuthn/passkey authentication security across dashboard and admin
• Develop threat models for anti-spoofing bypasses, API abuse, and credential stuffing attacks

What We're Looking For

• 7+ years of security engineering experience
• Deep knowledge of application security, cryptography, and secure API design
• Experience with security tools (SAST, DAST, SCA) integrated into CI/CD pipelines
• Understanding of compliance frameworks — SOC 2, GDPR, CCPA, and biometric data regulations
• Hands-on experience with WebAuthn/FIDO2 security model and passkey implementations
• Strong communication skills to drive security culture across engineering and leadership

Nice to Have

• Experience with biometric data protection regulations (BIPA, EU AI Act)
• Background in identity verification, fintech, or anti-fraud security
• Security certifications (CISSP, OSCP, CEH)

Our Hiring Process

We respect your time and aim to complete the entire process within 2-3 weeks. Here's what to expect:

1

Application Review

Application Review

3-5 days

Our team reviews your application within 5 business days. We look for relevant experience, passion for our mission, and alignment with our values.

2

Initial Call

Initial Call

30 minutes

A 30-minute video call with our recruiting team to learn about your background, discuss the role, and answer your questions about Xident.

3

Technical Assessment

Technical Assessment

1-2 hours

Role-specific evaluation—this might be a coding challenge, portfolio review, case study, or technical discussion depending on the position.

4

Team Interviews

Team Interviews

2-3 hours

Meet with 3-4 team members including your potential manager and cross-functional partners. We assess technical skills, collaboration, and culture fit.

5

Final Interview

Final Interview

45 minutes

A conversation with a company leader to discuss your career goals, our vision, and ensure mutual fit. This is also your chance to ask strategic questions.

6

Offer

Offer

24-48 hours

If it's a match, we move quickly. Expect a competitive offer within 48 hours of your final interview, with clear details on compensation and equity.

Our Values

Privacy by Design

We iterate quickly, gather feedback, and improve continuously.

Ownership Mentality

Everyone owns their domain end-to-end. No finger-pointing, just solutions.

Transparent by Default

We're happy to answer any questions before you apply. Reach out to our team anytime.