Staff Software Engineer, Security — Remote-First

Keycard; United States; Remote; USD 180,000 - 300,000; Full time

Benefits offered by this job

Health insurance

Dental coverage

Vision coverage

Remote-friendly

Job summary

Keycard is seeking a staff-level Software Engineer, Security to build and run the security program across product, infrastructure, and published assets. You will be the first dedicated security engineer, working with engineers who already understand the field.

The role focuses on preventing unauthorized access, auditing our token exchange, and strengthening platform defenses. Responsibilities include threat modeling, assuming compromise, design reviews, and running security tests with agents.

Qualifications

• Shipped and maintained production code with security focus.
• Able to read unfamiliar code, reproduce vulnerabilities, and ship fixes with regression tests.
• Knowledge of OAuth 2.0/2.1, OIDC, and token exchange (RFC 8693).

Responsibilities

• Threat modeling from token exchange to tool checks and MCP gateway.
• Assume compromise and document remaining capabilities.
• Review designs and code for token service, Cedar policy engine, MCP gateway, and CLI.
• Run scoped agents to test authorization, convert failures into CI regressions.
• Serve as technical voice during customer security reviews and pentests.

Skills

OAuth 2.0 / OIDC

Token exchange (RFC 8693)

IAM policy analysis

Security tooling

Code reading & exploitation

Agent security

Job description

Keycard is seeking a staff-level Software Engineer, Security to build and run the security program across product, infrastructure, and published assets. You will be the first dedicated security engineer, working with engineers who already understand the field.

The role focuses on preventing unauthorized access, auditing our token exchange, and strengthening platform defenses. Responsibilities include threat modeling, assuming compromise, design reviews, and running security tests with agents.