Keycard
Software Engineer, Security
US - Remote +1 · Remote · Full-time · Posted Oct 26, 2026
- Location
- US - Remote
Canada - Remote
About the job
Build and operate Keycard’s product and company security program, focusing on finding authorization vulnerabilities and automating controls and response.
What you'll do
- Threat-model, review, and test Keycard’s identity, credential, delegation, and policy systems; turn confirmed issues into fixes and CI regression tests.
- Build automated security controls for cloud accounts, delivery pipelines, credentials, dependencies, and deployments; coordinate incident response.
- Support customer security reviews and develop a product and company security roadmap, risk register, and incident roles.
What they ask for
- Have shipped and maintained production code and found and fixed application or identity-system vulnerabilities.
- Be able to analyze unfamiliar code, reproduce or exploit a vulnerability, and deliver a fix with a regression test.
- Know OAuth 2.0 and 2.1, OIDC, and token exchange (RFC 8693).
- Have built security tooling adopted by engineers and use agents for security work while checking their output and limiting access.
Nice to have
- Experience in identity infrastructure, developer tools, multi-tenant SaaS, DPoP, Cedar, SPIFFE/SPIRE, AWS security, agent/MCP security, or public security work.
Tools
OAuth 2.0, OAuth 2.1, OIDC, RFC 8693, Cedar, MCP, AWS, SPIFFE/SPIRE
AI focus
Use scoped agents to test product authorization and find or fix cloud and delivery misconfigurations; use agents for review, triage, or testing while checking outputs and limiting access.
Model-written summary · the original posting is authoritative