Software Engineer, Security

About Keycard

At Keycard, were building identity and access infrastructure for the agent-native era, where software isnt static but a dynamic, constantly changing system of AI agents working on behalf of people and businesses. Were backed by a16z, Boldstart, and Acrew, and our founding team built and scaled Snyk, Auth0, HashiCorp, and Heroku.

Were hiring a staff-level Software Engineer, Security. This is a software engineering role: youll build and run the security program for what Keycard ships and runs, across our product, our infrastructure, and what we publish, mostly as code and automation. Youd be the first engineer whose whole job is security, working with engineers who already know the field. It matters because security is what we sell: a hole in our token exchange or policy checks hands a customers agent access nobody granted. Keycard is a control plane for agents: identity, credential exchange, delegation, policy, and audit. It has to hold even when the agent itself is compromised. Youll also secure Keycard itself: our cloud accounts, customer-hosted deployments, our pipeline, and secrets. Platform engineering runs the infrastructure; operations handles audits and customer reviews. You prioritize product and company security work by risk to customers and Keycard.
Document what it can still do with its access.
Review designs and code across the token service, Cedar policy engine, MCP gateway, CLI, SDKs, and Console, mostly for who can do what and whether zones stay isolated.
Confirmed failures become CI regressions for token exchange, impersonation, or per-tool policy. Customer reviews.

Be the technical voice when customers security teams review or pentest us; operations runs the process.
Cloud and delivery controls.

Build agents that find and fix misconfigurations in cloud accounts, pipelines, and published artifacts, with scoped access and human review for their changes. With platform engineering, test isolation between deployments and audited break-glass access.
Design service identity and PKI, sign what we ship to customers, and manage dependency risk. Youve shipped and maintained production code, not only security tooling, and youve found and fixed vulnerabilities in applications or identity systems.
You can read unfamiliar code, build an exploit or reproduction, and ship the fix with a regression test.
You can spot the problem in an IAM policy, a network path, or a cloud audit log, even if youve never run cloud infrastructure.
You use agents for review, triage, or testing, and know how to check their output and limit their access.
Hands-on AWS security: Month one: map trust boundaries in token exchange and one priority delegation flow, attack them, and compare findings with our risk register. Review the company security setup with platform engineering.
Ship fixes for the findings we agree matter most, each with a CI regression.
Build reusable evidence for customer reviews and a triage process for pentest findings; questionnaires stay with operations.
By day 90: a product and company security roadmap with owners and incident roles, built from the risk register you now own.
Youd rather break the product yourself than wait for a customers red team to.
Build at the Frontier:

Work every day at the frontier of agent-native systems — shipping, inventing, and iterating on technology that hasn’t been built before. You’ll help shape an organization that embeds AI into its foundation as an enduring competitive advantage.
Compensation With Upside:

Market-competitive salaries and generous equity packages (4-year vest, 1-year cliff) give you the security to focus on building — and the asymmetric upside of ownership in a company chasing a category-defining mission.
Comprehensive Benefits & Recharge:

Health, dental, vision, and paramedical coverage for you and your family, plus 4 weeks vacation, 11 statutory holidays, and 1 volunteer day annually. A new MacBook Pro, a $500 stipend for peripherals, and the best AI tools available so you can work at the forefront of agent-native workflows.
Remote-First Flexibility:

We are a remote-first team prioritizing asynchronous collaboration, with hiring focused in North and South America.