SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Baselayer is rebuilding the identity infrastructure layer for American financial institutions. The company has built the most complete business graph in America, fusing public records, IRS data, sanctions lists, web signals, and fraud telemetry from 2,200+ financial institutions to resolve any business and its human stakeholders in milliseconds. Trusted by over 20% of US financial institutions including FIS, Rho, and Socure, Baselayer is expanding beyond finance into gig platforms, marketplaces, AI companies, and commerce infrastructure.
The company is now building KYA (Know Your Agent) — a cryptographic identity substrate designed for an era where AI agents act on behalf of people and businesses. Traditional identity models based on self-assertion (API keys, cookies, pixel trackers) break when the actor is an agent. KYA replaces self-assertion with third-party-issued, cryptographically verifiable credentials.
As Senior Engineer, Agentic Identity, you will own a meaningful surface of the KYA substrate and ship it to production. Responsibilities include:
• Build and maintain the runtime issuer/mint: OAuth Token Exchange (RFC 8693), JWS credentials (RFC 7515/7519, SD-JWT-VC), and Merkle audit log with real-time revocation.
• Own and evolve the wire format and claim registry: JWT profile, verification_level/verification_method enums, and regulatory crosswalks (eIDAS, NIST IAL, FATF CDD).
• Implement sub-millisecond JWS verification and Web Bot Auth signature checks (RFC 9421) at the HTTP edge for CDNs, merchants, and publisher paywalls.
• Build and maintain Passport — the user's cloud-resident principal account with canonical handle, KYC/KYB record, authorized-operators list, audit feed, and authenticator binding.
• Develop operator integration: embedded KYB onboarding inside OAuth 2.0 consent, per-operator opt-in, and webhook delivery via Svix.
• Work across a Python 3.13 monorepo (FastAPI, Cloud Tasks, Cloud Run, SQLModel/SQLAlchemy) and Go for performance-critical components.
You will join a small, high-ownership team solving real-time entity resolution at unprecedented scale. The technical depth is real: graph AI, retrieval, fraud modeling, graph embeddings, fraud propagation models, and sub-100ms latency traversal. There is minimal process between idea and shipping.
Minimum requirements: shipped systems where cryptographic correctness was load-bearing (OAuth/OIDC IdP, token issuer, signing service, HSM-backed signer, passkey/WebAuthn); fluency in Python and Go; ability to read RFCs as primary sources; deep understanding of identity vs. authorization, mandate vs. claim, snapshot vs. live state; production experience with async Python on Postgres including migration safety and observability.
Preferred experience: verifiable credentials / SSI / DID work (SD-JWT-VC, OID4VC, W3C VC stack); Certificate Transparency or append-only-log systems; KYC/KYB pipeline experience; edge/CDN engineering (Cloudflare Workers, Fastly Compute, Envoy, mTLS); familiarity with payment card specs (AP2, x402, MPP, UCP, Mastercard VI).
