Member of Technical Staff – Identity Engineer

About the role

Runlayer is building a secure platform for AI agents to operate inside enterprises. As an Identity engineer you will own the authentication and authorization layer that protects every AI‑to‑enterprise connection.

Key responsibilities

• Architect and implement OAuth 2.0, OIDC, Dynamic Client Registration and token management for MCP servers.
• Build and extend the OAuth broker that integrates with dozens of enterprise identity providers.
• Design identity propagation for AI agents, ensuring auditable access to enterprise systems.
• Define fine‑grained access‑control policies and collaborate with customers such as Gusto and Rippling.
• Contribute to the industry‑wide MCP Auth specification.

Required profile

• 5+ years of software engineering experience focused on identity, authentication or authorization.
• Deep knowledge of OAuth 2.0/OIDC, token exchange, audience restriction and DCR.
• Experience integrating with enterprise identity providers (Okta, WorkOS, Azure AD, SCIM).
• Strong fundamentals in distributed systems and API security.
• Comfortable working directly with enterprise customers.

Required skills

• Python (FastAPI)
• TypeScript (React)
• OAuth 2.0 / OIDC
• Dynamic Client Registration
• Okta, WorkOS, Azure AD, SCIM
• Kubernetes‑native authorization patterns
• Service mesh security

What we offer

• Competitive salary and equity
• Paid time off, including vacation, sick and parental leave
• Professional development budget for conferences and certifications
• Top‑tier equipment and choice of laptop
• Comprehensive health, dental and vision benefits