# Senior Engineer, Agentic Identity

**Company:** [Baselayer](https://hotfix.jobs/companies/baselayer)
**Location:** San Francisco, CA
**Role:** Backend Engineering
**Salary:** $230k – $340k/yr
**Experience:** 5+ years
**Skills:** Python, Go, Oauth 2.0, Openid Connect, Jws, Sd-Jwt-Vc, Webauthn, FastAPI, Postgres, Google Cloud Run, Sqlalchemy, Merkle Trees, Kubernetes
**Posted:** 2026-09-01

> Build production cryptographic identity infrastructure for AI agents, owning issuer, verification, Passport, or audit-log capabilities. The role requires strong Python or Go expertise, experience shipping security-critical identity systems, and deep familiarity with RFC-driven protocols and asynchronous Python services.

## Job Description

## Responsibilities
- Build and maintain the runtime issuer/mint, including OAuth Token Exchange (RFC 8693), JWS credentials (RFC 7515/7519, SD-JWT-VC), and a Merkle audit log with real-time revocation.
- Own and evolve wire formats and claim registries, including JWT profiles, verification-level and verification-method enums, and eIDAS/NIST IAL/FATF CDD crosswalks.
- Implement sub-millisecond JWS verification and Web Bot Auth signature checks (RFC 9421) at the HTTP edge for CDNs, merchants, and publisher paywalls.
- Build and maintain Passport, including canonical handles, KYC/KYB records, authorized operators, audit feeds, and authenticator binding.
- Develop operator integrations with embedded KYB onboarding, OAuth 2.0 consent, per-operator opt-in, and Svix webhook delivery.
- Work in a Python 3.13 monorepo using FastAPI, Cloud Tasks, Cloud Run, and SQLModel/SQLAlchemy, plus Go for performance-critical substrate components.

## Requirements
- Shipped systems where cryptographic correctness was load-bearing, such as OAuth/OIDC identity providers, token issuers, signing services, HSM-backed signers, or passkey/WebAuthn flows.
- Fluency in Python and Go, or strong proficiency in one with a demonstrated ability to learn the other quickly.
- Ability to read RFCs as primary sources and form informed opinions on JWK thumbprint canonicalization, pairwise subject derivation, and Signature-Input header serialization.
- Deep understanding of identity versus authorization, mandate versus claim, and snapshot versus live state.
- Production experience with asynchronous Python and PostgreSQL, including migration safety and observability.

## Nice to Have
- Verifiable credentials, SSI, DID, SD-JWT-VC, OID4VC, or W3C VC experience.
- Certificate Transparency, Trillian, or similar append-only log experience.
- KYC/KYB pipeline experience, including provider abstraction, evidence retention, regulatory level mapping, and ownership-chain resolution.
- Edge/CDN engineering with Cloudflare Workers, Fastly Compute, Envoy filters, or mTLS at the edge.
- Familiarity with AP2, x402, MPP, UCP, or Mastercard VI specifications.

## Compensation and Benefits
- Salary: $230,000–$340,000 plus equity.
- Flexible PTO.
- 100% company-paid health, dental, and vision premiums.
- 401(k) with company match.
- HSA contributions on applicable plans.
- $250 monthly gym stipend.

## Similar jobs

- [Software Engineer, Payments](https://hotfix.jobs/jobs/a46c6643-d146-4f9f-babc-bab17b9b0139) - Gusto - New York, NY - $222k – $245k/yr
- [Senior Software Engineer](https://hotfix.jobs/jobs/5b7d1570-77db-4db5-b3f6-acd44865ac7a) - Stripe - Remote - $221k – $286k/yr
- [Senior Software Engineer, Growth Enablement](https://hotfix.jobs/jobs/32aed70e-a4f4-4e0c-9d18-3e6beff3f1e6) - Replit - Foster City, CA - $220k – $320k/yr
- [Senior Software Engineer, Platform](https://hotfix.jobs/jobs/02a0557f-64ab-44af-85ac-ce963e318c17) - Scale AI - San Francisco, CA - $216k – $270k/yr
- [Senior Software Engineer, Lending Products](https://hotfix.jobs/jobs/970b63f1-1426-4ac6-97be-290b75c73213) - Parafin - San Francisco, CA - $215k – $275k/yr

**Apply:** https://hotfix.jobs/jobs/58e67c27-0770-499f-b68b-073b64e3415f
**Canonical:** https://hotfix.jobs/jobs/58e67c27-0770-499f-b68b-073b64e3415f