Token Security

About the Role Token Security, a leading platform for Agentic AI and Non-Human Identity (NHI) security, is looking for a DevOps engineer to own our infrastructure end to end. You would be our only one. There is no platform team to join and no one to hand you a ticket queue. There is plenty of work, and most of it is on this page. You will set the technical direction as we grow, report to the Head of Engineering, and work directly with every engineer on the team. We run on AWS and Kubernetes and deploy through GitOps. Our use of AI in engineering is growing quickly, and the infrastructure behind it has not caught up yet. Building that is a real part of this job. What You’ll Do • Own all of our infrastructure. Kubernetes, AWS, and the core services around them. The foundation was built properly and the team has kept it running between other priorities. You are not inheriting a mess. What it has not had is a full-time owner. Reliability, cost, security posture, and the roadmap all become yours. • Own CI/CD. Every service’s build and deploy pipeline, and the self-hosted runner infrastructure underneath. We ship fast and we are working on shipping faster. One of our engineers is automating more of it right now, and you will take that over and push it further. The interesting problem is adding the safety a growing company needs without turning deploys into something people dread. • Help us shape the infrastructure behind our AI development. Our engineers use coding agents every day and that use keeps growing. We do not have a clear path for the infrastructure behind it yet, and you will help us find one. One direction we are exploring is moving agents off laptops and into the cloud, with a sandbox environment per engineer so an agent keeps working after the laptop is closed. Deciding whether that is the right answer, and building what we choose, is part of this job. • Scale how we deploy to customers. Some customers need us to run inside their own environment. We already do this, but each deployment takes too much hands-on work. You will make it repeatable, faster, and secure, and give our engineers the tooling to support customers directly. • Own our observability. Metrics, logs, alerting, and dashboards. Decide what is worth waking someone for, and keep the cost of watching under control. • Own infrastructure security and support our compliance work. Hardening, IAM, secrets, and vulnerability management. You will help us keep our SOC 2 compliance, which customers require before they will work with us, and help answer their security reviews. We sell to security teams, so they ask hard questions. • Keep our data recoverable. Backups, restore testing, and a disaster recovery plan for RDS Postgres and ClickHouse that we have actually rehearsed. • Partner with engineers on solutions, not tickets. You are the person developers come to when they need infrastructure to do something new. What You’ll Bring • 6+ years in DevOps, infrastructure, or platform engineering. • Real production Kubernetes experience, preferably EKS. • Deep AWS knowledge. VPC, IAM, and networking, at a level where you can explain the trade-offs behind your design. • Infrastructure as code. Terraform or Terragrunt. • Ownership of CI/CD pipelines, GitHub Actions preferred. • Hands-on work with AI coding agents such as Claude Code or Codex, as part of your daily workflow. • A security-first mindset. You think about blast radius and least privilege by default, not after review. • Clear communication. You will work with every engineer here, and sometimes with our customers. You can explain a technical trade-off to someone who does not share your background. • Accountability. You will be the only person who owns Token’s infrastructure, and that is what you want. Nice to Have • GCP or Azure alongside AWS. • GitOps with ArgoCD, and writing Helm charts. • Python, or another language you use to build real internal tooling. Our services are Python. • ClickHouse, or another column store used for high volume log and event data. • RDS Postgres in production. Tuning, upgrades, and failover. • Experience building or operating security, identity, or compliance products. • Prior experience as an early or founding infrastructure hire. Our Stack EKS, Karpenter, KEDA, ArgoCD, Helm, Terragrunt, Crossplane, GitHub Actions with self-hosted runners, Datadog. Python services, with RDS Postgres as our main application database and ClickHouse for the large volumes of log and event data we ingest from customers. We will show you what we think is good about this setup and what we know is not. We would rather you see it clearly before you join than after. Is This You? This role fits if you want to own a system rather than a slice of one, you like working directly with engineers and customers, and you have strong opinions about infrastructure that you can defend. To be clear about what ownership means here: you own the technical decisions and the quality of the platform. Priorities we set together, based on what the company needs most at the time. It does not fit if you want a narrow, predefined scope, or an established platform team to learn from. Why Token Security Machine identities and AI agents now outnumber people in almost every company, and hardly any of them are governed the way human identities are. Token Security closes that gap, so organizations can adopt AI with confidence rather than with crossed fingers. As our only DevOps engineer you own the foundation the rest of it runs on. The decisions you make in your first year will still shape how we ship three years from now. Own it boldly is one of our three company values. This role is that value written as a job description. Offices in Tel Aviv and New York. Stock options for every employee, hybrid work, and a kitchen that is actually stocked.

About the Role Token Security is looking for a Senior Security Researcher to join our research team. In this role, you will be at the bleeding edge of AI security, leading deep-dive research into AI products, LLM frameworks, and modern Agentic AI ecosystems. You will combine hands-on defensive and offensive research techniques with Tokenʼs cutting-edge platform to analyze modern AI products, dissect non-human identity architectures, and uncover privilege escalation paths in dynamic AI agent workflows. In this role, you will bridge deep security research, product engineering, and technical storytelling turning novel insights into real-world enforcement mechanisms, core platform capabilities, high-impact blogs, and talks at top global security conferences. What We Do The Frontier of Identity and Agentic AI Security Token Security is pioneering the AI Agent & Non-Human Identity NHI) security space. Research-Driven Innovation Our research directly powers our product capabilities uncovering complex identity attack vectors, analyzing enterprise AI products, and building security enforcement models for autonomous AI Agents. Thought Leadership & PR We showcase our findings to the broader security community through technical publications, vulnerability disclosures, and global conference presentations. Innovation via Automation We use AI Agents ourselves to accelerate research workflows, streamline environment analysis, and build smarter security checks. Direct Market & Product Impact Our research bridges deep technical investigation and real-world defense, powering core platform enforcement 1 Senior Security Researcher capabilities, threat intelligence, and high-impact advisory for global enterprise customers. Your Responsibilities • Agentic AI & Product Security Research: Perform deep technical analysis on modern AI products, SaaS LLM offerings, and agentic tools to expose security gaps, privilege escalation risks, and data leakage vectors. • Enforcement & Architectural Design: Research and prototype security enforcement models to protect, monitor, and govern autonomous AI Agents, enforcing token boundaries and runtime access controls. Public Research, PR & Thought Leadership: Author technical blog posts, research papers, and vulnerability disclosures. Represent Token Security by submitting and presenting original research at top global security conferences (e.g., Black Hat, DEF CON, RSA). • AI Driven Research Methodology: Leverage AI Agents and modern AI tooling to scale research workflows, automate environment discovery, and accelerate vulnerability analysis across complex environments. • Hands-on Research in POCs: Conduct deep security research into active customer environments during key POCs, identifying complex NHI and AI misconfigurations to build actionable, high-impact security reports. • Cross-Functional Impact: Collaborate closely with Product, Engineering, and Sales to convert research findings into automated detections, platform features, and executive presentations. What You Bring • 5+ years of experience in security research, cloud security research, defensive or offensive security, or vulnerability research. • AI & Agentic Security Expertise: Practical experience or deep technical research into AI architectures, LLM execution pipelines, API security, and agentic execution environments. • Understanding of Organizational Security & IAM Thorough understanding of organizational security, cloud environments, and enterprise IAM models, as 2 Senior Security Researcher well as enterprise AI platforms and SaaS AI ecosystems (e.g., OpenAI, Claude Enterprise, Copilot). • Technical Writing & Public Speaking • Proven ability (or strong desire) to articulate complex research findings into engaging technical blogs, whitepapers, and public presentations for global security audiences. • Scripting & Development • Advanced proficiency in modern programming/scripting languages to write custom research tools, interact with APIs at scale, and build dynamic agent workflows. Analytical Problem Solver • Ability to analyze how enterprise AI products work end-to-end and invent novel, frictionless ways to enforce security policies without breaking user experience or usability. • Fluent English (written and verbal). Nice to have: • Track record of speaking at security conferences (e.g., Black Hat, DEF CON, RSA, OWASP, BSides). • Published security advisories, CVEs, or high-impact technical blog posts. Location & Employment Details Employment Type Full-Time Work Model: Hybrid – Tel Aviv, Israel In-office with Work From Home on Tuesdays

About the Role Token Security, a leading platform for Non-Human Identity (NHI) management, is seeking a highly skilled Backend Engineer to join our dynamic team. The ideal candidate will have expertise in Backend technologies, with a strong focus on cloud infrastructures and event-driven architecture. This role will be central to developing and maintaining robust, scalable, and high-performance solutions that secure machine and non-human identities in cutting-edge ecosystems. What You’ll Do • Design, develop, and maintain efficient and scalable cloud-native backend systems with a focus on securing token-based and machine identities. • Build and enhance API integrations with third-party applications to facilitate secure data collection and sharing. • Own the architecture of NHI agent services, ensuring scalability, networking efficiency, robust security, and data storage optimization. • Develop advanced monitoring and automation tools to maintain system stability and deliver performance benchmarks. • Design and implement big data solutions and pipelines for large-scale data processing and analytics using tools like Spark and Snowflake. • Take ownership of projects, driving them end-to-end from ideation and design to development, deployment, and maintenance. • Work collaboratively with cross-functional teams to define, design, and launch innovative features tailored to the NHI ecosystem. • Drive a customer-first mindset by understanding the users' needs and developing solutions that exceed expectations. What You’ll Bring • 6+ years of experience as a Backend Engineer, with a track record of building and maintaining scalable backend systems. • Expertise in event-driven architecture and building microservices for large-scale applications. • In-depth knowledge of cloud platform services (AWS preferred, GCP/Azure experience is a plus). • Practical experience with containerized environments • Familiarity with queuing and messaging systems, such as SQS, Kafka, or RabbitMQ. • Strong understanding of security best practices, particularly in securing token-based systems and non-human identities. • Bonus: Familiarity with Python, TypeScript, CI/CD pipelines, and infrastructure-as-code tools like Terraform. Join us in shaping the future of Token security and redefining the standards for managing non-human identities