Senior Security Engineer

Aspiron Search; United States; Remote; USD 280,000 - 320,000; Full time

Benefits offered by this job

Equity

Job summary

Aspiron Search Limited is seeking a Senior/Staff Security Engineer for a remote role within the US. The position comes with $280-$320k per year plus equity and the opportunity to own major security initiatives across the platform and client environments.

You will focus on product security, cloud, pipelines, and secrets, while leading customer security reviews and pen tests. Autonomy and ownership are emphasized for senior staff.

Qualifications

• Production code you've shipped and maintained, ideally in Go or TypeScript.
• Real vulnerabilities found and fixed in applications or identity systems, from exploit to regression test.
• OAuth 2.0/2.1, OIDC and token exchange

Responsibilities

• Product security first, then securing the company's own cloud, pipeline, and secrets.
• Trace an agent's access from token exchange to the per-tool check, then attack it.
• Assume the agent is compromised and prove it can't escape or cross tenants.
• Review designs and code across the token service, policy engine, gateway and SDKs.
• Lead the technical side of customer security reviews and pentests.

Skills

Go/TS backend

OAuth 2.0 / OIDC

IAM policy

Cloud audit logs

AWS

Security tooling

Token exchange

Penetration testing

CI/CD security

Tools

AWS

Job description

Senior/Staff Security Engineer - Remote within the US - $280-$320 + equity

Aspiron are working with a market leader in the agentic control-plane/telemetry space who work with multiple enterprise clients already, integrating with their existing identity solutions to secure agentic processes.

Fresh out of stealth with a $25M+ Series A, they're now looking to hire a Senior/Staff Security Engineer with a dual mandate: Secure the house; Secure their clients.

Their novel approach allows agents to obtain a verified identity set against a single task and policy/telemetry to confirm what it's doing on every part of the tool call.

Why we like this client?

I could go on all day about what you can gain from the role and what skills you need, but honestly, it's nicer to talk about why we like working with them:

• Friendly and encouraging team - no bs here
• Office in SF but can offer fully remote within the US (they meet about 2-3 times a year)
• They operate in one of the most invested areas of cyber right now, agentic identity. Morgan Stanley says it could more than double the identity security market, from $24BN to $60BN, within two years
• The agentic space is far from solved, you can contribute to a leading company looking to make sense through some of the AI noise out there
• Seniors here get good autonomy, not just building but owning the entire project/area
• The founders have a strong track record of building/scaling some of the best known developer/security and identity firms about.

Sounds good, what will I do there?

Product security first, then securing the company's own cloud, pipeline, and secrets.

Break it before anyone else does

• Trace an agent's access from token exchange to the per-tool check, then attack it: confused deputies, token passthrough, poisoned tools, prompt injection.
• Assume the agent is compromised and prove it can't escape or cross tenants.
• Review designs and code across the token service, policy engine, gateway and SDKs.
• Point agents at an isolated instance and turn every confirmed failure into a CI regression.
• Lead the technical side of customer security reviews and pentests.

Secure the company itself

• Build agents that find and fix cloud and pipeline misconfigurations, with a human signing off.
• Own internal credentials, PKI and release signing, and use the product to fence in the company's own agents.
• Run security response, from investigation to automated detection.

What you'll bring

A software engineer first: you can build a fix, not just plaster a problem.

• Production code you've shipped and maintained, ideally in Go or TypeScript (I'm open to other Backend languages too)
• Real vulnerabilities found and fixed in applications or identity systems, from exploit to regression test.
• OAuth 2.0/2.1, OIDC and token exchange
• Strong experience with IAM policy, network path or cloud audit log.
• Expert in AWS .
• Security tooling other engineers actually adopted.
• Agents already in your workflow, and a clear sense of where they need checking.

Nice to have:

• Identity Infra
• DPoP/Cedar