SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Obsidian Security is a unicorn-status cybersecurity company (Series D, $1.1B valuation, August 2026) protecting the SaaS and non-human identity layer that modern enterprises depend on. The company detects identity-based and supply chain attacks in real time across Salesforce, Snowflake, AI agents, and other third-party applications, and enforces least-privilege access. Trusted by Fortune 500 companies including T-Mobile, Workday, and Snowflake, Obsidian is scaling R&D in agentic AI security.
In this role, you will own agent security content end-to-end: from research and design through production deployment, tuning, and customer adoption. You'll investigate how AI agents (coding assistants, desktop agents, workflow automation, MCP-connected tools) can misbehave or be compromised, then design detections and policies, build them into Obsidian's engines and pipelines, test rigorously, ship, document, and refine based on real-world customer data. You are accountable for each piece of security content delivering measurable value in customer environments.
This is a hands-on technical role requiring deep expertise in agent architectures, attack vectors, and detection engineering. You'll work across engineering, product, and customer-facing teams to explain attack chains and translate research into production security controls.
**Requirements:**
- Hands-on knowledge of how agentic tools work: tool calling, hooks and lifecycle events, MCP servers and transports, skills and plugins, permission modes
- Solid grasp of agent-specific attack classes: direct and indirect prompt injection, tool and description poisoning, confused-deputy and excessive-agency issues, secret leakage into context, malicious or over-permissioned MCP servers and extensions
- Ability to distinguish real risk from theoretical risk and explain the difference to customers
- Strong SQL proficiency, ideally on analytical stores like ClickHouse, Databricks, or Snowflake
- Disciplined testing discipline: builds reproducible test cases (positive and negative) before shipping
- Proficient scripting in Python or Go, sufficient to build test harnesses, parse event logs, and perform detections
- Working knowledge of SaaS and cloud identity (OAuth, PATs, API tokens, scopes) and developer tooling (Git, GitHub/GitLab, CI/CD)
- Ability to explain agent attack chains to engineers, product teams, and customer-facing staff
**Nice to Have:**
- Published research, CVEs, talks, or blog posts on LLM or agent security
- Familiarity with threat detection
- Hands-on endpoint security experience on macOS, Linux, or Windows
- Experience with dbt, Dagster, or other data-pipeline tooling
- Background in SaaS security, CASB/SSPM, or insider-threat products
- Heavy daily use of Claude Code, Copilot, Cursor, or similar with informed opinions on their security models
