Security Software Engineer

Job Summary

Focused on securing identity and access infrastructure, the full-time remote Security Software Engineer will write, review, and maintain production code for the token service, policy engine, and gateway while leading security initiatives and incident responses.

Key responsibilities

• Conduct threat modeling and attack simulations to identify vulnerabilities in the product's security architecture
• Establish security protocols for cloud accounts and manage incident responses for vulnerabilities and security events
• Collaborate with engineering teams to review designs and code, ensuring proper access controls and isolation of zones

Required qualifications

• Proven experience shipping and maintaining production code, with a focus on security vulnerabilities in applications or identity systems
• Strong understanding of OAuth 2.0 and 2.1, OIDC, and token exchange (RFC 8693), with the ability to identify and address related issues
• Experience in reading and analyzing unfamiliar code to build exploits or reproductions and implementing fixes with regression tests
• Knowledge of risk assessment and the ability to articulate attack paths and collaborate on solutions with the team
• Familiarity with using agents for review, testing, or triage processes in security contexts