Staff Software Engineer (Security)

Location: Remote in the United States or Canada; hiring focused in North and South America.

Company

hirify.global builds identity and access infrastructure for AI agents, including verified identities, short-lived task-scoped credentials, delegation, policy enforcement, and auditability.

What you will do

• Threat-model agent access flows across token exchange, delegation, per-tool authorization, and the MCP gateway.
• Review designs and production code across the token service, Cedar policy engine, MCP gateway, CLI, SDKs, and Console.
• Run scoped agents against isolated instances, investigate authorization failures, and turn confirmed issues into CI regressions.
• Set cloud, pipeline, customer-cell, credential, PKI, dependency, and break-glass security controls.
• Investigate vulnerabilities and security events, coordinate fixes, and improve security on-call processes.
• Support customer security reviews and pentests, build reusable evidence, and own product and company security roadmaps.

Requirements

• Staff-level software engineering experience with production code ownership and maintenance.
• Experience finding and fixing vulnerabilities in applications or identity systems.
• Ability to read unfamiliar code, build exploits or reproductions, ship fixes, and add regression tests.
• Knowledge of OAuth 2.0 and 2.1, OIDC, token exchange under RFC 8693, and failures such as refresh-token misuse.
• Ability to identify security issues in IAM policies, network paths, and cloud audit logs.
• Strong risk judgment, including explaining attack paths, sizing risk, and agreeing on fixes with engineering.
• Experience using agents for review, triage, or testing while checking their output and limiting their access.
• Experience in identity infrastructure, developer tools, or multi-tenant SaaS.

Nice to have

• Experience with DPoP, Cedar, or SPIFFE/SPIRE.
• Hands-on AWS security experience with IAM, SCPs, logging, and infrastructure as code.
• Experience securing agents or MCP servers, including tool permissions and sandboxing.
• A security tool adopted by engineers that ended a class of bugs.
• Public security work such as CVEs, bug bounties, write-ups, or OAuth and MCP standards work.

Culture & Benefits

• Remote-first work with asynchronous collaboration and autonomy.
• Agent-native development culture with daily use of AI agents.
• Market-competitive salary and equity with a four-year vesting schedule and one-year cliff.
• Health, dental, vision, and paramedical coverage for employees and families.
• Four weeks of vacation, 11 statutory holidays, and one volunteer day annually.
• MacBook Pro, a $500 peripherals stipend, and access to AI tools.

Hiring process

• In the first month, map trust boundaries, attack a priority delegation flow, compare findings with the risk register, and review the security setup with platform engineering.
• Within 90 days, establish a product and company security roadmap with owners and incident roles.