Senior Engineer, Agentic Identity

Baselayer•San Francisco, CA

15h•Hybrid

About The Position

Baselayer is hiring an engineer for its Agentic Economy team to build and ship a production surface of KYA (Know Your Agent), a cryptographic identity substrate for agents acting on behalf of people and businesses. The role may own the issuer mint, edge verification, Passport, or Merkle audit log. The system replaces self-asserted identity with third-party-issued credentials that counterparties can verify. The engineer will build and maintain credential issuance and verification systems, evolve the wire format and claim registry, and implement cryptographic checks at the HTTP edge. The role also covers Passport, a cloud-resident principal account, and operator integrations. Work spans a Python 3.13 monorepo using FastAPI, Cloud Tasks, Cloud Run, and SQLModel/SQLAlchemy, plus Go for performance-critical components. The Agentic Economy team is a small senior group working with payment networks, banks, wallet providers, and agent platforms. The position is based in San Francisco and works in the office four days per week.

Requirements

Have shipped systems where cryptographic correctness was load-bearing, such as an OAuth/OIDC identity provider, token issuer, signing service, HSM-backed signer, or passkey/WebAuthn flow.
Be fluent in Python and Go, or be strong in one language with a track record of learning the other quickly.
Read RFCs as primary sources and have informed opinions on JWK thumbprint canonicalization, pairwise-sub derivation, and Signature-Input header serialization.
Have a deep understanding of the distinction between identity and authorization, mandate and claim, and snapshot and live state.
Have production experience with async Python on Postgres, including migration safety and observability.

Nice To Haves

Verifiable credentials, SSI, or DID experience, especially with SD-JWT-VC, OID4VC, or the W3C VC stack.
Certificate Transparency, Trillian, or similar append-only-log experience.
KYC/KYB pipeline experience, including provider abstraction, evidence retention, eIDAS/FATF CDD level mapping, or ownership-chain resolution.
Edge/CDN engineering experience with Cloudflare Workers, Fastly Compute, Envoy filters, or mTLS at the edge.
Familiarity with AP2, x402, MPP, UCP, or Mastercard VI specifications and how identity works alongside mandate.

Responsibilities

Build and maintain the runtime issuer/mint, including OAuth Token Exchange (RFC 8693), JWS credentials (RFC 7515/7519 and SD-JWT-VC), and a Merkle audit log with real-time revocation.
Own and evolve the wire format and claim registry, including the JWT profile, verification_level and verification_method enums, and eIDAS/NIST IAL/FATF CDD crosswalk.
Implement sub-millisecond JWS verification and Web Bot Auth signature checks (RFC 9421) at the HTTP edge for counterparty CDNs, merchants, and publisher paywalls.
Build and maintain Passport, including the user's cloud-resident principal account, canonical handle, KYC/KYB record, authorized-operators list, audit feed, and authenticator binding.
Develop operator integration, including embedded KYB onboarding during first OAuth 2.0 consent, per-operator opt-in, and webhook delivery via Svix.
Work across the Python 3.13 monorepo and Go performance-critical substrate components.