Senior Staff Engineer - Agentic Identity

Cisco•San Francisco, CA

1d•$214,100 - $309,800

About The Position

Cisco is seeking a Senior Staff Engineer to define and build foundational identity, authentication, and governance infrastructure for AI agents and other non-human callers. The role addresses identity and access management needs as agents execute searches, call APIs, and orchestrate actions involving critical customer data. It involves greenfield architectural challenges at enterprise scale across cloud, on-premises, and hybrid environments. As a technical leader, you will set strategy and take solutions from concept through production deployment, translating complex identity and access challenges into resilient enterprise-grade software. The work includes agent identity frameworks, developer tools and APIs, cross-functional architectural alignment, engineering standards, mentorship, and rapid prototyping and validation of production-ready capabilities.

Requirements

Bachelor’s degree in Computer Science, Computer Engineering, Electrical Engineering, or a related technical field and 12+ years of software engineering experience, or a Master’s degree and 8+ years of relevant experience.
10+ years of experience designing and building distributed systems, backend services, or security platforms in production environments.
5+ years of experience implementing enterprise identity, authentication, or access protocols such as OAuth 2.0/2.1, OIDC, SAML, SCIM, LDAP, SPIFFE, or mTLS.
4+ years of experience with containerization technologies such as Docker, containerd, or Kubernetes and at least one major cloud platform (AWS, Azure, or GCP).
3+ years of experience with security engineering principles, including threat modeling, attack-path analysis, or security architecture reviews.

Nice To Haves

Experience designing or securing AI-adjacent architectures, tool-using agentic workflows, policy control layers, or MCP authorization.
Deep technical expertise developing multithreaded, high-throughput server-side applications in Go, C/C++, or Java on Linux.
Familiarity with AI-specific security risks, including prompt injection, tool misuse, privilege escalation, and unsafe delegation patterns.
Experience contributing to industry standards bodies such as IETF, OpenID Foundation, or AuthZEN, or presenting at technical industry conferences.
Working knowledge of device trust integrations, endpoint posture assessment, and hardware-backed identity signals for policy enforcement.

Responsibilities

Design and implement scalable identity and access management frameworks for AI agents, including token exchange, credential brokering, workload identity, and delegated access models.
Build reusable APIs, SDKs, CLI tools, and integration patterns, including Model Context Protocol (MCP)-based access.
Partner with Security, AI Platform, Product, and Cloud Operations teams to align identity architecture with operational constraints and customer workflows.
Set architectural direction, conduct design and code reviews, establish engineering standards for non-human identity, and mentor engineering talent.
Rapidly prototype solutions to ambiguous identity and security problems, validate them with internal and external partners, and iterate them into scalable production services.
Lead technical strategy from initial concept through production deployment across cloud, on-premises, and hybrid architectures.

Benefits

Medical, dental, and vision insurance, subject to plan eligibility rules.
401(k) plan with a Cisco matching contribution.
Paid parental leave.
Short- and long-term disability coverage and basic life insurance.
Potential eligibility for Cisco restricted stock unit grants, which vest following continued employment for defined periods.
Paid holidays, plus a floating holiday for non-exempt employees.
Paid birthday day off, paid year-end holiday shutdown, and paid personal wellness days.
Vacation time for non-exempt employees; exempt employees participate in a flexible vacation time off program with no defined limit, subject to availability and business limitations.
Sick time off, with unused sick time carryover up to the stated limit.
Additional paid time away may be requested for critical or emergency family issues.
Optional paid volunteer days.
Annual bonuses may be available for non-sales roles, subject to Cisco policies.