# Senior Engineer, Agentic Identity

**Company:** [Baselayer](https://hotfix.jobs/companies/baselayer)
**Location:** San Francisco, CA
**Role:** Security Engineering
**Salary:** $230k – $340k/yr
**Experience:** 5+ years
**Skills:** Python, Go, OAuth, OIDC, Jws, Sd-Jwt-Vc, Jwt, Rfc 8693, Rfc 7515, Rfc 7519, Rfc 9421, FastAPI, Postgres, Sqlalchemy, Sqlmodel
**Posted:** 2026-07-01

> Build and own core components of KYA (Know Your Agent), a cryptographic identity substrate for AI agents using verifiable credentials, JWS, OAuth, and Merkle logs. Requires production experience shipping cryptographically correct identity systems in Python and Go.

## Job Description

## What You'll Do
- Build and maintain the runtime issuer/mint: OAuth Token Exchange (RFC 8693), JWS credentials (RFC 7515/7519, SD-JWT-VC), and Merkle audit log with real-time revocation.
- Own and evolve the wire format and claim registry: JWT profile, verification_level/verification_method enums, and eIDAS/NIST IAL/FATF CDD crosswalk.
- Implement sub-millisecond JWS verification and Web Bot Auth signature checks (RFC 9421) at the HTTP edge for counterparty CDNs, merchants, and publisher paywalls.
- Build and maintain Passport - the user's cloud-resident principal account with canonical handle, KYC/KYB record, authorized-operators list, audit feed, and authenticator binding.
- Develop operator integration: embedded KYB onboarding inside first OAuth 2.0 consent, per-operator opt-in, and webhook delivery via Svix.
- Work across a Python 3.13 monorepo (FastAPI, Cloud Tasks, Cloud Run, SQLModel/SQLAlchemy) and Go for performance-critical substrate components.

## Minimum Requirements
- Shipped systems where cryptographic correctness was load-bearing: OAuth/OIDC IdP, token issuer, signing service, HSM-backed signer, passkey/WebAuthn flow, or similar.
- Fluent in Python and Go, or strong in one with a track record of learning the other quickly.
- Reads RFCs as primary sources and holds informed opinions on JWK thumbprint canonicalization, pairwise-sub derivation, and Signature-Input header serialization.
- Deep understanding of the distinction between identity and authorization, mandate and claim, snapshot and live state.
- Production experience with async Python on Postgres, including migration safety and observability.

## What Sets You Apart
- Verifiable credentials / SSI / DID work - especially SD-JWT-VC, OID4VC, or the W3C VC stack.
- Certificate Transparency, Trillian, or similar append-only-log experience.
- KYC/KYB pipeline experience: provider abstraction, evidence retention, eIDAS/FATF CDD level mapping, ownership-chain resolution.
- Edge/CDN engineering - Cloudflare Workers, Fastly Compute, Envoy filters, or mTLS at the edge.
- Familiarity with AP2, x402, MPP, UCP, or Mastercard VI specs and how identity rides alongside mandate.

## Similar roles

- [Security Engineer, Detection and Response](https://hotfix.jobs/jobs/ad36f4af-adb4-4f56-9cf2-412bc3302227) - Notion - San Francisco, CA - $230k – $260k/yr
- [Manager, GRC Subject Matter Experts, Product](https://hotfix.jobs/jobs/36e666cc-cc41-42c2-a93f-0fd3c7363c35) - Vanta - Remote - $230k – $311k/yr
- [Security Engineer - Tech Lead](https://hotfix.jobs/jobs/8cfaaaab-7daf-4731-8dc4-6131fca0e597) - Luma AI - Palo Alto, CA - $230k – $360k/yr
- [Security Architecture Lead](https://hotfix.jobs/jobs/f0fce5f5-9d5e-42ec-ade2-3a5d749ca2f8) - Replit - Foster City, CA - $228k – $363k/yr
- [Senior Security Engineer](https://hotfix.jobs/jobs/62309998-452a-45f9-8dd9-ed880eb50a2d) - Vanta - Remote - $227k – $267k/yr

**Apply:** https://hotfix.jobs/jobs/854f4cd6-219a-48bf-b2b4-4cdaef0947e3
**Canonical:** https://hotfix.jobs/jobs/854f4cd6-219a-48bf-b2b4-4cdaef0947e3