Security Architect

About the Company Our Client is building an AI-enabled desktop and agent platform for engineering work. As AI agents become more capable, enterprises need to be able to adopt them without giving up control of identity, permissions, data, approvals, or auditability. Our Client is building the infrastructure that makes that possible. About the Role We're looking for a Staff Enterprise AI Security & Governance Architect to own the architecture and hands-on implementation of our enterprise security control plane. This is a highly technical Staff-level role. You'll work across identity, authorization, endpoint security, networking, policy enforcement, observability, AI agent security, and enterprise deployment. You'll also work directly with enterprise security and IAM teams to turn complex security requirements into production capabilities. ResponsibilitiesOwn the architecture for enterprise security across Our Client's desktop, agent runtime, cloud services, customer environments, and model providers.Design and build secure delegated authentication and authorization using technologies such as OAuth 2.0, OIDC, enterprise federation, short-lived credentials, and least-privilege access.Build policy controls that govern what AI agents can retrieve, modify, send, publish, commit, or delete - with fail-closed behavior and human approval where appropriate.Design data and egress controls including customer gateways, private endpoints, destination allowlists, data-class routing, retention controls, and secretless access.Build trustworthy audit and provenance systems that allow customers to reconstruct what happened during an AI-assisted workflow.Establish security patterns for prompt injection, untrusted content, tool invocation, generated code, plugins, model routing, and data exfiltration.Integrate enterprise security infrastructure including IAM providers, gateways, SIEMs, immutable archives, and observability platforms.Design deployment architectures across cloud, customer-gateway/BYOK, customer-hosted, and disconnected environments.Lead threat modeling, adversarial testing, security reviews, incident-readiness exercises, and secure deployment gates.Write production-quality code and build prototypes to validate architectural decisions.Partner closely with Product, Engineering, Customer Security, IAM, Legal, and GTM teams to translate enterprise requirements into durable product capabilities.Lead technical workshops with enterprise security and IAM teams and communicate architectural decisions clearly to both technical and non-technical stakeholders.Mentor engineers and raise the bar for secure distributed-systems and enterprise architecture. Qualifications10+ years of experience building security, identity, platform, or distributed systems, with demonstrated Staff-level technical leadership.Deep hands-on experience with OAuth 2.0, OIDC, delegated authorization, enterprise federation, token lifecycles, workload identity, secrets management, and least-privilege architecture.Experience designing authorization or policy enforcement systems using technologies such as OPA, Cedar, relationship-based access control, or similar policy engines.Strong understanding of desktop and cloud security, including process boundaries, local IPC, proxies, TLS/mTLS, streaming APIs, service identities, private networking, and secure software updates.Experience building auditable event pipelines, SIEM integrations, immutable storage, retention systems, and incident-reconstruction workflows.Strong programming ability in Python and/or TypeScript.Practical experience threat-modeling systems involving untrusted content, prompt injection, tool invocation, generated code, plugins, software supply chains, and data exfiltration.Excellent technical judgment and the ability to distinguish verified system behavior from assumptions or future roadmap.Strong customer-facing communication skills, particularly with enterprise security and IAM organizations. Required SkillsExperience with Microsoft Entra ID, Microsoft Graph, Conditional Access, Azure AI Foundry, Azure API Management, Key Vault, Azure Monitor, or managed identity.Experience securing systems in regulated, safety-sensitive, or IP-intensive environments.Experience with enterprise SaaS and customer-hosted deployments.Familiarity with SAML, SCIM, tenant isolation, data residency, and enterprise security/privacy requirements.Experience with AI agent frameworks, tool protocols, model gateways, retrieval systems, model evaluation, red teaming, provenance, or human-in-the-loop workflows.Familiarity with SOC 2, ISO 27001, NIST CSF/800-53, and secure software supply-chain practices. Preferred SkillsExperience with Microsoft Entra ID, Microsoft Graph, Conditional Access, Azure AI Foundry, Azure API Management, Key Vault, Azure Monitor, or managed identity.Experience securing systems in regulated, safety-sensitive, or IP-intensive environments.Experience with enterprise SaaS and customer-hosted deployments.Familiarity with SAML, SCIM, tenant isolation, data residency, and enterprise security/privacy requirements.Experience with AI agent frameworks, tool protocols, model gateways, retrieval systems, model evaluation, red teaming, provenance, or human-in-the-loop workflows.Familiarity with SOC 2, ISO 27001, NIST CSF/800-53, and secure software supply-chain practices. Pay range and compensation package This isn't a policy or compliance position. You'll be the technical owner of the security architecture that determines whether enterprises can safely deploy AI agents into real engineering workflows. You'll have the authority to establish security invariants and block a pilot or release when identity, authorization, egress, approval, evidence, or incident controls aren't ready. At the same time, you'll work closely with Product and Engineering to make those controls practical, scalable, and usable. Equal Opportunity Statement If you're a hands-on security architect who wants to define how enterprises safely adopt AI agents - and still wants to write code and build the systems yourself - we'd love to talk.