---
title: 'Member of Technical Staff - Identity at Runlayer'
canonical: 'https://feeny.ai/job/member-of-technical-staff-identity-runlayer-new-york-z92af65wqav1'
type: 'job'
last_seen: '2026-10-17'
---

# Member of Technical Staff - Identity at Runlayer

- **Company:** Runlayer
- **Location:** New York, NY
- **Employment:** full-time
- **Work type:** hybrid
- **Posted:** 2026-04-10
- **Last confirmed live:** 2026-10-17
- **Apply:** https://jobs.ashbyhq.com/runlayer/ab4554fa-7aca-4799-80d9-5f54f606ac21/application

**Skills:** OAuth 2.0, OIDC, Dynamic Client Registration, Token Exchange, Python, TypeScript, FastAPI, React, Okta, WorkOS, Auth0, AWS IAM, GCP IAM, Distributed Systems, API Security, SCIM, Kubernetes, Service Mesh Security, ML Security, Differential Privacy

> Architect and implement authentication and authorization systems for MCP servers and AI agents. Build and extend the OAuth broker for enterprise identity integrations while defining fine-grained access control policies.

## Job description

## About Runlayer

AI is transforming how every company operates, but most enterprises are stuck. They want to move fast with AI Agents, tools, and workflows, but they can't do it safely. We're fixing that.

Our team built AI Actions for OpenAI, shipped Zapier Agents to millions of users, and launched the first remote MCP server with Anthropic. We helped establish the protocol, and now we're building the platform enterprises need to actually put AI to work.

Runlayer is one platform for MCPs, Skills, and Agents: purpose-built security, fine-grained governance, and complete observability so organizations can go all-in on AI across the entire company without the risk. We just raised a $30M Series A led by Felicis, with participation from Khosla Ventures, bringing our total raised to $42M. Already trusted by Gusto, Instacart, Opendoor, dbt Labs, and Decagon.

## About the Role

As an Identity engineer, you'll own the authentication and authorization layer that secures every AI-to-enterprise connection on Runlayer, from the OAuth broker behind our enterprise integrations to how AI agents prove who they are and get auditable access. You'll work directly with customers and help shape the MCP Auth spec that defines how agent identity works industry-wide.

## Why You'll Thrive Here

- Impact: Own the identity and authentication layer that secures every AI-to-enterprise connection on our platform.
- Excellence: Work alongside engineers who've shipped AI systems at scale.
- Ownership: Shape how MCP & AI agent authentication works, from spec-level decisions to production code.

## What You'll Do

- Architect and implement authentication and authorization systems for MCP servers (OAuth 2.0, Dynamic Client Registration, token management).
- Build and extend our OAuth broker that handles enterprise identity integrations across dozens of vendors.
- Design identity propagation for AI agents, ensuring secure, auditable access to enterprise systems.
- Integrate with enterprise identity providers (Okta, WorkOS, Azure AD) and SCIM systems.
- Define fine-grained access control policies for MCP tools and resources.
- Collaborate directly with customers like Gusto and Rippling to solve real-world identity challenges.
- Contribute to the MCP Auth spec and help define how agent identity works industry-wide.

## What We're Looking For

- 5+ years of software engineering experience with significant focus on identity, authentication, or authorization systems.
- Deep experience with OAuth 2.0/OIDC, including DCR, token exchange, and audience restriction.
- Background building or integrating with enterprise identity systems (Okta, WorkOS, Auth0, AWS IAM, GCP IAM).
- Strong fundamentals in distributed systems and API security.
- Experience with Python and TypeScript (our stack is Python/FastAPI backend, TypeScript/React frontend).
- Comfortable working directly with enterprise customers to understand and solve their security requirements.
- Heavy AI user who leverages tools like Claude Code or Cursor to multiply output.

Bonus Qualifications

- Experience with Kubernetes-native authorization patterns or service mesh security.
- Background in ML security (differential privacy, LLM security research).
- Prior work on identity for multi-tenant SaaS platforms.
- Familiarity with the MCP specification.

## What We Offer

We provide a competitive package designed to attract and retain top talent who can work effectively with enterprise customers.

- Competitive salary and equity — compensation that reflects your expertise and customer-facing responsibilities.
- Paid time off — paid vacation, paid sick leave, and paid parental leave.
- Professional development — budget for conferences, courses, and certifications in AI, enterprise software, and customer success.
- Top-tier equipment — your choice of laptop and accessories to create your ideal work environment.
- Health benefits — comprehensive health, dental, and vision coverage.
- Customer interaction opportunities — work directly with innovative companies and see the immediate impact of your work.

Not quite the right fit? Reach out to careers@runlayer.com with details about your experience and interests.

## About Runlayer

## Company Overview
- **One-liner**: Runlayer provides an AI control plane that enables enterprises to securely govern, deploy, and monitor AI agents and tools across their organization.
- **Entity Type**: Private (Series A)
- **Headquarters**: New York, New York, United States
- **Founded**: 2025
- **Founders**: Andrew Berman (CEO), Tal Peretz, Vitor Balocco

## Core Business
- **Primary industry**: Enterprise AI Security & Governance / AI Infrastructure
- **Target customers**: B2B, Enterprise (engineering, security, IT, operations, and business teams)
- **Mission or purpose statement**: Give every employee the golden path to use agents, then watch adoption multiply. AI enablement, security, and control in one platform.

## Products & Services
- **Runlayer Agents**: On-demand agents running on Runlayer infrastructure. Employees can create agents for recurring work while platform owners keep approved tools, scoped credentials, policy, and audit in place.
- **Runlayer Catalog**: Reusable skills and plugins teams can publish and share with agents, giving AI capabilities an owner, approval state, dependency context, and usage history.
- **MCP Gateway**: Approved MCP (Model Context Protocol) access across AI clients and third-party agents, routing requests through identity, policy, and audit controls.
- **Runlayer Watch**: Shadow AI discovery and response tool that finds unmanaged MCPs, skills, plugins, and client configs.
- **Runlayer Guard**: Execution-time security checks for AI tool use, inspecting risky tool behavior before sensitive actions continue.
- **Agent IAM & Governance**: Actor-aware access control for AI usage, evaluating who is acting, which client or agent is involved, and what conditions apply.
- **ROI & Observability**: Adoption metrics, decisions, findings, and audit history showing what teams use and where access is blocked.

## Market Standing
- **Valuation/Market Cap**: Not publicly disclosed
- **Key Metric**: Total Funding of $41M ($11M Seed in November 2025, $30M Series A in June 2026)
- **Notable Investors/Partners**: Felicis (lead), Khosla Ventures (lead). Backed by the best minds in AI & security, including the Head of Security from Cursor.
- **Growth Signals**: 
  - Raised $30M Series A in June 2026 from Felicis & Khosla Ventures
  - Named to "Rising in Cyber 2026"
  - Named the default for AI-native teams like Instacart, Gusto, Lemonade, dbt Labs, and AngelList
  - Headcount of 24 employees with +11.5% monthly growth
  - Operating in 5 countries (US, Poland, Israel, Spain, Canada)
  - Founding team has raised over $200M cumulatively and built AI at scale (Zapier MCP, Zapier Agents)

## Competitive Advantages
- **Founding team expertise**: Co-founders built and launched Zapier MCP (Zapier's fastest growing product) and Zapier Agents, used by millions. They have firsthand experience solving the exact problem Runlayer addresses.
- **Comprehensive platform**: Unlike a simple MCP gateway, Runlayer adds catalog, identity controls, reusable capabilities, observability, and agent workflows — making governed agent work practical across the entire company.
- **Enterprise-ready**: Supports SSO/SCIM, self-hosted deployment, MDM rollout, and a sophisticated policy model that maps access to users, groups, roles, attributes, agent accounts, clients, tools, resources, and runtime conditions.
- **18,000+ pre-built MCPs**: Start with a massive library of MCPs for common enterprise tools, plus the ability to add internal MCPs.
- **Shadow AI discovery**: Unique capability to surface unmanaged AI usage from agents, MCPs, skills, plugins, and client configs.

## Strategic Focus
- **Current priorities**: Scaling the platform to meet enterprise demand, expanding the agent runtime and catalog, deepening security and governance capabilities, and growing the go-to-market team.
- **Direction for growth**: Becoming the default AI control plane for enterprises rolling out AI agents across engineering, security, IT, operations, and business teams.

## Why Work Here
- **Culture highlights**: Values include "Shipping," "Built this before," and leveraging AI internally. The team is described as "AI experts" who have built AI at scale. Emphasis on practical, real-world problem solving.
- **Remote/hybrid/office policy**: Hybrid/Remote roles available. Offices in NYC and San Francisco. Some roles are specifically NYC or SF-based.
- **Notable perks or engineering culture**: 
  - Founding team with deep AI expertise (Zapier, Nanit, Vowel)
  - Working on cutting-edge AI infrastructure and security problems
  - Small, high-impact team (24 employees) with significant funding ($41M)
  - Open roles across Engineering (Security, SRE, Platform, Identity, Product), Product (Design, Engineering), and GTM (Field Engineering, Demand Gen, Forward Deployed Engineer, Product Marketing, Enablement, Creative Director, Account Executive, Developer Relations)
  - Talent sourced from top companies: Zapier (6 employees), EQ Fitness, Rilla, Taboola, Nanit, Oso, Intel, GLG, C3 AI, Permit.io

## Sources
1. [runlayer.com](https://www.runlayer.com/)
2. [runlayer.com/about](https://www.runlayer.com/about)
3. [runlayer.com/platform](https://www.runlayer.com/platform)
4. [linkedin.com/company/runlayer](https://www.linkedin.com/company/runlayer)
5. [cbinsights.com](https://www.cbinsights.com/company/runlayer)
6. [jobs.ashbyhq.com/runlayer](https://jobs.ashbyhq.com/runlayer)

## Other roles at Runlayer

- [Deployment Strategist](https://feeny.ai/job/deployment-strategist-runlayer-new-york-a6rr4a5zdfrw) — New York, NY / United States
- [Member of Technical Staff - Security Research](https://feeny.ai/job/member-of-technical-staff-security-research-runlayer-new-york-02f1mczzwkpr) — New York, NY
- [Member of Technical Staff - Infrastructure](https://feeny.ai/job/member-of-technical-staff-infrastructure-runlayer-new-york-4nd8kxr9jm5a) — New York, NY
- [Business Operations](https://feeny.ai/job/business-operations-runlayer-new-york-17fq1f18d1m6) — New York, NY
- [Go-To-Market (GTM) Systems Leader](https://feeny.ai/job/go-to-market-gtm-systems-leader-runlayer-new-york-msb9w9bhbbt0) — New York, NY
- [Field Marketing Manager](https://feeny.ai/job/field-marketing-manager-runlayer-new-york-1jgmnn34mdg0) — New York, NY
- [Senior Designer, Brand](https://feeny.ai/job/senior-designer-brand-runlayer-new-york-4gmw1tstqhsh) — New York, NY / United States
- [Strategic Finance Lead](https://feeny.ai/job/strategic-finance-lead-runlayer-new-york-0jgdt5dhfvn8) — New York, NY
- [Integrations Engineer](https://feeny.ai/job/integrations-engineer-runlayer-new-york-can07vq3sbtp) — New York, NY
- [Regional Sales Director, East](https://feeny.ai/job/regional-sales-director-east-runlayer-new-york-3487wesj7km1) — New York, NY