Senior Engineer, Agentic Identity

Baselayer•San Francisco, CA

6d•$230,000 - $340,000•Hybrid

About The Position

Baselayer is building an identity layer for institutions by combining public records, IRS data, sanctions lists, web signals, and fraud telemetry into a graph that resolves businesses and the people behind them. The Agentic Economy team is extending that graph into a trust layer for agentic commerce, including verifiable credentials, a real-time queryable registry, and verification APIs for networks, platforms, and protocols. The Senior Engineer, Agentic Identity will own a meaningful part of Baselayer’s KYA (Know Your Agent) cryptographic identity substrate—such as issuer mint, edge verification, Passport, or the Merkle audit log—and take it to production. The role involves building credential issuance and verification systems, evolving identity wire formats and claims, and integrating with operators and counterparties. The team works across a Python 3.13 monorepo and Go components, collaborating with payment networks, banks, wallet providers, and agent platforms.

Requirements

Have shipped systems where cryptographic correctness was load-bearing, such as an OAuth/OIDC identity provider, token issuer, signing service, HSM-backed signer, passkey/WebAuthn flow, or similar.
Be fluent in Python and Go, or be strong in one and have a track record of quickly learning the other.
Read RFCs as primary sources and hold informed opinions on JWK thumbprint canonicalization, pairwise-sub derivation, and Signature-Input header serialization.
Have a deep understanding of the distinction between identity and authorization, mandate and claim, and snapshot and live state.
Have production experience with async Python on Postgres, including migration safety and observability.

Nice To Haves

Experience with verifiable credentials, SSI, or DID work, especially SD-JWT-VC, OID4VC, or the W3C VC stack.
Experience with Certificate Transparency, Trillian, or a similar append-only log.
KYC/KYB pipeline experience, including provider abstraction, evidence retention, eIDAS/FATF CDD level mapping, or ownership-chain resolution.
Edge/CDN engineering experience with Cloudflare Workers, Fastly Compute, Envoy filters, or mTLS at the edge.
Familiarity with AP2, x402, MPP, UCP, or Mastercard VI specifications and how identity works alongside mandate.

Responsibilities

Build and maintain the runtime issuer/mint, including OAuth Token Exchange (RFC 8693), JWS credentials (RFC 7515/7519 and SD-JWT-VC), and a Merkle audit log with real-time revocation.
Own and evolve the wire format and claim registry, including the JWT profile, verification_level and verification_method enums, and eIDAS/NIST IAL/FATF CDD crosswalk.
Implement sub-millisecond JWS verification and Web Bot Auth signature checks (RFC 9421) at the HTTP edge for counterparty CDNs, merchants, and publisher paywalls.
Build and maintain Passport, the user's cloud-resident principal account with a canonical handle, KYC/KYB record, authorized-operators list, audit feed, and authenticator binding.
Develop operator integration, including embedded KYB onboarding during the first OAuth 2.0 consent, per-operator opt-in, and webhook delivery via Svix.
Work across a Python 3.13 monorepo using FastAPI, Cloud Tasks, Cloud Run, and SQLModel/SQLAlchemy, and use Go for performance-critical substrate components.