> Markdown version of [/jobs/ext/1486054-security-engineer-labrnyth](https://www.wearedevelopers.com/jobs/ext/1486054-security-engineer-labrnyth). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Security Engineer - Labrnyth - **Company:** INFINITY CORP. - **Location:** United States (Remote available) - **Contract:** Permanent contract - **Skills:** Artificial Intelligence, Amazon Web Services, Amazon S3, Cloud Computing Security, DevOps, Identity and Access Management, Python (Programming Language), Key Management, PostgreSQL, Open Web Application Security, Systems Development Life Cycle, Secure Coding, SQL Databases, TypeScript, Data Processing, Data Classification, Large Language Models, Software Security, Amazon Virtual Private Cloud (VPC), Backend, Front End Software Development - **Published:** July 29, 2026 - **Apply:** https://www.indeed.com/viewjob?jk=cd7db29e1cb6c2cb ## About the Role * Multi-tenant isolation: hard account isolation via PostgreSQL forced RLS + account_id, transaction-bound authorization contexts, and service/worker roles. ## Description Patent Intelligence is an active Labrynth engagement delivering an AI-assisted patent intelligence platform. The next product is an invite-only B2C platform for personal and team accounts, built as a greenfield product alongside the current application. Because it handles commercially sensitive (and potentially export-controlled) patent material, security is a first-class requirement. This is a contract engagement (Agency / Statement of Work), with an initial term of 60-90 days and the option to extend, reporting to the Patent Project engineering lead and coordinating with GRC, Backend, DevOps/Platform, and Frontend. The Security contractor reviews and adversarially tests the platform's boundaries, account isolation, external identity/access, and application and AI-agent security, and, alongside the live GRC program, drives SOC 2 Type II readiness. The role does not own application authorization policy (Backend) or the secure-defaults / infrastructure substrate (DevOps); it reviews and verifies these rather than building them. Meaningful overlap with US and Australian project hours is required for the weekly sync and incident response. What You'll Do * Threat-model (STRIDE/PASTA) the B2C architecture, focused on account isolation (PostgreSQL forced RLS + account_id, S3, the BFF boundary, Cognito), external access, and the AI/agent surface. * Run adversarial tenant-isolation testing: prove forged, reused, stale, and pooled-connection authorization contexts fail closed under direct runtime-role SQL, and that cross-account denial holds even when BFF route authorization is bypassed in a test harness. * Review the BFF authorization boundary, the Amazon Cognito identity/access model (customer + operator pools), secrets management, and least-privilege IAM. * Verify data-protection controls: encryption in transit/at rest, data classification, customer-content-safe telemetry, S3 Object Lock evidence integrity, and export-controlled content handling. * Map SOC 2 Type II controls and drive evidence collection via Drata, coordinated with GRC, with owners assigned. * Review CI security-gate policy (dependency/container/IaC/secret scanning) and assess AI/LLM risk (prompt injection, tool data-exfiltration, over-broad tool access) across the public read-only MCP surface. * Build incident-response plans and runbooks, coordinate third-party pen tests, and hand over a prioritized remediation backlog and documented security posture., * Identity & access: external-user identity/access over Cognito (customer + operator pools); authentication/authorization review and least-privilege roles. * Application security: OWASP Top 10 in practice; threat modeling (STRIDE/PASTA); secure code review across Python/TypeScript services. * Cloud security: securing AWS, IAM, KMS, Secrets Manager, VPC Lattice with IAM authorization, network exposure, safe defaults, S3 public-access blocking and Object Lock. * Compliance (SOC 2 Type II): hands-on evidence workflows; Drata experience strongly valued, coordinating with an active GRC program. * Data protection: encryption in transit/at rest, data classification, and handling of sensitive / export-controlled content. * Secure SDLC & AI risk: reviewing dependency/container/IaC/secret scanning and CI security gates; LLM/agent risks relevant to a public read-only MCP surface. Nice to Have * Export-control / IP-sensitive data handling and client-segregation controls. * Serving legal disclosures / ToS and recording acceptance at onboarding. * Adversarial testing of RLS and pooled-connection authorization contexts. * VPC Lattice service-to-service authorization review (SigV4). * Incident-response tabletop exercises and coordinating third-party pen tests. * Privacy frameworks relevant to the clients' jurisdictions., Labrynth is committed to fair and competitive pay, ensuring that compensation reflects both market conditions and the value each team member brings. Hourly rates are determined based on factors such as location, relevant experience, skills, internal pay equity, and market conditions. During the interview process, your Talent Acquisition Partner will confirm the hourly rate range applicable to your location. For contractors outside the U.S., compensation is aligned with local market conditions and cost of living. While every engagement is unique, our compensation philosophy is designed to ensure fairness, consistency, and competitiveness across Labrynth. Additional details regarding compensation, contract terms, and the scope of the engagement will be discussed throughout the hiring process. ## Related Videos - [From DevOps to Scaled DevOps: How We’re Rebuilding Continuous Delivery as a Platform](https://www.wearedevelopers.com/videos/100018-from-devops-to-scaled-devops-how-we-re-rebuilding-continuous-delivery-as-a-platform) - [Developing the Backend with Stefan Lingler, CTO at Shpock](https://www.wearedevelopers.com/videos/100360-developing-the-backend-with-stefan-lingler-cto-at-shpock) - [WeAreDevelopers LIVE - CSS is DOOMed](https://www.wearedevelopers.com/videos/1838-wearedevelopers-live-css-is-doomed) - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [DevOps Maturity Check – a way to balance autonomy and alignment](https://www.wearedevelopers.com/videos/58-devops-maturity-check-a-way-to-balance-autonomy-and-alignment) - [Can Machines Dream of Secure Code? Emerging AI Security Risks in LLM-driven Developer Tools](https://www.wearedevelopers.com/videos/1217-can-machines-dream-of-secure-code-emerging-ai-security-risks-in-llm-driven-developer-tools) ## Related Articles - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [How We Built a Worry-Free System That Runs for 10+ Years – And What We’d Do Again](https://www.wearedevelopers.com/magazine/751-how-we-built-a-worry-free-system-that-runs-for-10-years-and-what-we-d-do-again) - [Dev Digest 132 - Binging WADFlix?](https://www.wearedevelopers.com/magazine/473-dev-digest-132-binging-wadflix) - [Dev Digest 137 - AI'm not sure about this](https://www.wearedevelopers.com/magazine/485-dev-digest-137-ai-m-not-sure-about-this) - [Dev Digest 138 - Are you secure about this?](https://www.wearedevelopers.com/magazine/486-dev-digest-138-are-you-secure-about-this) - [Dev Digest 120 - Apple and peers](https://www.wearedevelopers.com/magazine/455-dev-digest-120-apple-and-peers)