Member of Technical Staff, Security
Palo AltoFull-timePosted 2mo ago
About the role
Build the security foundations for enterprise agentic apps, ensuring authority boundaries, data protection, and robust platform security across user-facing apps, APIs, runtimes, and delivery systems.
Responsibilities
- Lead threat modeling and security architecture for agent products, APIs, connectors, execution environments, customer applications, and platform services.
- Build production security controls for authentication, authorization, delegated agent identity, workload identity, credential brokering, tenant isolation, encryption, policy enforcement, and auditability.
- Design isolation boundaries for untrusted code and generated content, including sandboxing, network and resource controls, browser containment, and safe communication with trusted services.
- Identify and remediate vulnerabilities through design review, code review, targeted security assessment, hands-on exploitation, and adversarial testing, with clear severity, exploitability, ownership, verification, and exception handling.
- Develop reusable libraries, services, policies, test harnesses, and developer tooling that eliminate vulnerability classes rather than documenting the same mistake repeatedly.
- Participate in incident response from triage and containment through root-cause analysis, remediation, evidence preservation, and control improvement.
- Translate enterprise security requirements into defensible engineering controls and evidence, without allowing questionnaire-driven work to replace actual risk reduction.
- Raise the security capability of the engineering organization through clear design patterns, direct coaching, useful reviews, and tools engineers want to use.
Qualifications
- 5-12 years of software or security engineering experience (with possible exceptions for exceptional individuals)
- Strong software-engineering fundamentals and evidence of building, shipping, and operating security-relevant production systems
- Strong understanding of trust boundaries, least privilege, identity, authorization, secrets, cryptography, isolation, secure software design, and common web and distributed-systems vulnerabilities
- Attacker’s curiosity paired with builder’s judgment, with production-safe implementations
- Practical risk judgment to prioritize high-leverage work and avoid security theater
- Collaborative approach that raises engineering velocity and ownership
- Clear written and verbal communication skills
- AI-native mindset: using modern AI systems and coding agents while validating findings and remediation
- Comfort with startup ambiguity, broad ownership, and occasional customer travel
- Experience securing AI or agent systems is valuable but not required
- Background in product-security, platform-security, identity, cloud-security, developer-security, offensive-security, or security-focused software-engineering is applicable if focused on agent threat model
Skills
Required:Threat modeling
Benefits
- Competitive cash compensation
- Meaningful equity
- growth opportunities within a security-focused, early-stage architecture direction
Last updated Oct 22, 2026. Interested? Apply on the company site.
About Sycamore
The Trusted Agent Operating System
Sycamore: The trusted agent operating system for the enterprise.
Progressive Trust SystemAdaptive System GenerationContinuous ImprovementCollective IntelligenceTrust by designSecureCompliantAuditable
More open roles at Sycamore
- Forward Deployed Engineer3d agoHybrid (Palo Alto)
- Chief of Staff to the CEO3d agoHybrid (Palo Alto) · Go-to-Market & Operations
- Member of Product Staff3w agoHybrid (Palo Alto, CA) · Products
- Deployment Strategist1mo agoHybrid (Palo Alto) · Go-to-Market & Operations
- Marketing Intern2mo agoHybrid (Palo Alto) · Go-to-Market & Operations