Member of Technical Staff (Security)

The Role
Footprint sells trust to banks and fintechs: verify an identity, vault the PII, and prove to an auditor that every step was done correctly. The architecture reflects four years of that job. Identity records live in an AWS Nitro Enclave-backed vault as an append-only ledger, and our SDKs collect sensitive data straight from end-user devices.

This year the surface changed. Percy, our AI agent platform, now runs AI-powered agents in isolated Modal sandboxes that make compliance and risk decisions on live PII. An agent that acts on real identity data raises new questions: what the sandbox can reach, and how does a person's most sensitive data stay safe while an AI system works on it. At the same time, our customers' diligence teams keep asking harder security questions, because our audit trails are part of what they're buying.

Footprint was built with strong security foundations, but we're hiring the first person to fully own the product's security boundary end to end. This is an engineering seat: you'll spend most of your time in the product, with security as your lens.

You'll inherit a real security architecture: hardware attestation, KMS-based key management, an audit ledger designed to be tamper-evident, secret management, and compliance programs that already pass their audits. Assessment, hardening, security tooling, and the standards engineering builds against all become yours.

You'll report directly to the Head of Engineering - Elliott Forde.

What You'll Own
Vault and enclave security. The Nitro Enclave-backed vault holds millions of identity records. Encryption, key management, hardware attestation, the integrity of the append-only audit ledger, and cross-tenant isolation are yours to assess, harden, and stand behind

The Percy sandbox boundary. The agents run in isolated Modal sandboxes against live PII. Sandbox isolation, token scoping, network egress, and the integrity of agent audit logs are the newest and fastest-moving part of this job - you set the standards here

The end-user data path. From a stranger's phone through our SDKs into the vault: PII collection, document capture, and the generative UI layer that renders screens off agent decisions. You own the security review of everything that touches an end user

Document pipeline integrity. Forged documents are an adversarial input, and the attackers iterate. Tamper detection, classification, and fraud checks all have to hold against that - adversarial robustness of this pipeline is yours

Product security in our compliance programs. Footprint runs SOC 2 Type 2, PCI DSS Level 1, GDPR, and ISO 27001. The programs have their own owner, but the product-security controls inside them are yours: the technical evidence, the remediations, and the deep technical answers when an auditor or a customer's security team pushes past the questionnaire. You scope and run our technical pentests, and you own product and infrastructure vulnerability remediation through to resolution

Stack
Rust · TypeScript · Postgres · AWS (Nitro Enclaves, KMS, IAM, VPC, CloudTrail, GuardDuty) · Modal · Vercel

Deep experience with most of this, and the judgment to pick up the rest, is what matters.

Must-Have
5+ years of hands-on security engineering - application security, infrastructure security, or both

You understand encryption, key management, and access control well enough to audit a production system holding millions of PII records, and to say precisely where it's weakest

You know how code execution environments get escaped, how to enforce least privilege on ephemeral compute, and how cross-tenant leaks actually happen

You've done offensive work - pen testing, threat modeling, or vulnerability research - and it changed how you build

You've secured AWS environments hands-on: IAM, VPC, KMS, CloudTrail, GuardDuty

You've been through a SOC 2 or PCI DSS audit and translated real controls into evidence an auditor accepted

You've shipped security fixes nobody assigned you - you find gaps and close them on your own initiative

Nice-to-Have
You've secured AI/LLM agent systems or autonomous code execution. Percy is the fastest-growing surface here, and prior art is thin - if you have real experience, it counts for a lot

You know trusted execution environments (AWS Nitro Enclaves, Intel SGX). The vault lives inside one

You've worked on document fraud detection or adversarial robustness of ML pipelines. Our document pipeline faces deliberate attacks, and it has to hold

You've worked in Rust. The vault and core services are built in it

You've built security tooling - SAST, DAST, CI/CD gates. That work is a first-year deliverable of this role, so having done it before counts

You know the KYC and identity verification space. It's the regulatory context the whole product lives in