Principal Software Engineer (SaaS Agent Security)
About The Position
Palo Alto Networks is hiring a Principal Software Engineer to architect defenses, build monitoring pipelines, and manage governance for agentic AI workflows, API permissions, and enterprise SaaS-to-SaaS or agent-to-SaaS connections. The role focuses on securing coding agents such as Claude Code, Codex, and Cursor. The engineer will design runtime protections for autonomous AI agents, operationalize SaaS and API security, secure identity and non-human access, and develop monitoring and incident response capabilities. The role also partners with SRE, AI/ML research, product, and compliance teams to incorporate security guardrails into CI/CD and deployment pipelines. Palo Alto Networks describes its mission as protecting the digital way of life and its values as Disruption, Collaboration, Execution, Integrity, and Inclusion. The company says most teams work from the office full time, with flexibility when needed. The position is eligible for immigration sponsorship. Compensation may include restricted stock units and a bonus; the listed annual base salary range is $156,400 to $253,000.
Requirements
- At least 5 years of experience in information security, cloud security engineering, or application security.
- Deep understanding of agentic AI risks, including prompt and indirect injection, OAuth abuse, privilege escalation, and data leakage across LLM and agent stacks.
- Strong understanding of enterprise SaaS platforms such as Salesforce, M365, Google Workspace, and ServiceNow, as well as SSPM platforms.
- Proficiency in scripting and automation; Java is preferred, with Python, Go, or Bash also listed for security automation and API integrations.
- GCP basics, including ability to configure GCP, understand BQ, and work in the GCP Console.
Nice To Haves
- CISSP, CCSP, or cloud-native security credentials.
Responsibilities
- Architect security controls for autonomous AI agents, including sandboxing, runtime policy enforcement, and execution safety monitoring.
- Deploy, integrate, and operationalize SaaS agent security and data security to monitor third-party and internal SaaS risk.
- Secure OAuth flows, OpenID Connect (OIDC), SAML/SSO, API token privileges, and agent-to-SaaS authorization models.
- Build production-grade security tooling, automated telemetry collection, and incident response playbooks for agent and SaaS anomalies.
- Partner with SRE, AI/ML research, product, and compliance teams to incorporate guardrails into CI/CD and deployment pipelines.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Principal
Education Level
No Education Listed
