Staff Security Engineer — Identity & Access (Remote)

Keycard; Oregon; Hybrid; USD 180,000 - 240,000; Full time

Benefits offered by this job

Frontier autonomy

Agent-native culture

Competitive equity

Benefits & vacation

MacBook Pro + $500 stipend

Remote-first

Job summary

Keycard is hiring a staff-level Software Engineer, Security to build and run the security program across product, infrastructure, and publishings. You’ll be the first security-focused engineer, partnering with engineers to close holes early and create tooling for future threats.

Remote-first role with strong autonomy, equity upside, and a focus on protecting token exchanges, delegation, and policy enforcement in a multi-tenant, auditable system.

Qualifications

• Shipped and maintained production code, not only security tooling.
• Can read unfamiliar code, build a reproduce, and ship regression tests.
• Knowledge of OAuth 2.0/OIDC and token exchange (RFC 8693).
• Can spot problems in IAM policy, cloud logs, or network paths.
• Built security tooling that reduces recurring bugs and can explain coverage and gaps.
• Experience with agents and how to limit their access.

Responsibilities

• Threat modeling across token exchange, delegation, and per-tool checks.
• Assume compromise and document residual capabilities.
• Design review of token service, Cedar policy engine, MCP gateway, CLI, SDKs, and Console.
• Attack with scoped agents and chase authorization failures to CI regressions.
• Serve as technical voice during customer security reviews; coordinate with operations.

Skills

Production code

Vulnerability fixes

Code reading

OAuth 2.0/OIDC

IAM policy

Security tooling

Agent-native systems

Job description

Keycard is hiring a staff-level Software Engineer, Security to build and run the security program across product, infrastructure, and publishings. You’ll be the first security-focused engineer, partnering with engineers to close holes early and create tooling for future threats.

Remote-first role with strong autonomy, equity upside, and a focus on protecting token exchanges, delegation, and policy enforcement in a multi-tenant, auditable system.