Full-Stack Software Engineer

About the Role

Build secure, reliable software that helps security teams work more effectively. As a Full-Stack Software Engineer supporting Global Information Security, you'll develop user interfaces, back-end services, APIs and data integrations, and take ownership of those systems in production. You'll work primarily with the Security Operations Centre and collaborate across identity and access management, privileged access management, cloud security, network security, data protection and vulnerability management. You'll also build Model Context Protocol (MCP) integrations and AI agent workflows where they offer practical value. This is a software-engineering-first role: we value sound technical judgment, maintainable code and complete, supportable solutions—not just prototypes.

What You'll Do

• Design, build and maintain full-stack applications, REST APIs and data integrations that address real security operations needs.
• Partner with analysts, engineers and stakeholders to shape requirements and deliver practical software they can use in their daily work.
• Write readable, maintainable code; contribute to architecture, automated testing, code reviews and technical documentation.
• Create and maintain CI/CD pipelines for build, test, security checks and deployment; package services with Docker and contribute to Kubernetes-based deployments.
• Deploy and operate application services on a major cloud platform, using managed compute, storage, databases, secrets management and identity services.
• Support production systems through monitoring, alerting, incident investigation, reliability improvements and lifecycle management.
• Apply secure development practices, including input validation, least-privilege access, secrets management, audit logging and appropriate approval controls.
• Build and maintain MCP servers that expose security tools, APIs and data to AI assistants through clear schemas, structured outputs and reliable error handling.
• Secure MCP integrations with authentication, authorization, scoped access and attributable invocation logs; require explicit approval for destructive or high-impact actions.
• Develop AI agent workflows for alert enrichment, evidence gathering, log summarization and triage, integrating LLM APIs and retrieval where useful.
• Implement agent guardrails, including tool-access controls, iteration and cost limits, timeouts, human checkpoints and safe fallback behavior; test outcomes and track regressions.
• Choose between deterministic software, automation and agents based on the problem; measure impact through adoption, time saved, accuracy and service quality, and collaborate across time zones.

What You Bring

• 2–5 years of professional software engineering experience, including delivering front-end applications and back-end services and supporting software in production.
• Strong proficiency in a modern front-end language and framework, such as TypeScript/JavaScript with React or an equivalent.
• Strong back-end programming skills. Java is preferred; equivalent depth in Python, C# or Node.js is also considered.
• Experience with REST API design and integration, authentication, and relational or document-oriented databases.
• Solid fundamentals in automated testing, debugging, code review, version control and maintainable software design, plus practical CI/CD experience.
• Working knowledge of Docker, including building and troubleshooting images and running containerized applications.
• Basic familiarity with Kubernetes pods, deployments, services, configuration and logs, and application deployment using core services on AWS, Azure or Google Cloud. Deep Kubernetes administration or cloud architecture expertise is not required.
• Working knowledge of MCP and hands-on experience building or extending at least one MCP server, or a comparable tool-calling integration that exposes internal systems to an LLM.
• Practical experience integrating LLM APIs into application code, including tool/function calling and structured output handling.
• Basic working knowledge of an AI agent or orchestration framework. LangGraph and LlamaIndex are preferred; LangChain, Semantic Kernel or similar frameworks are also acceptable. Understand agent loops, tool registration, state handling and retrieval basics.
• Awareness of prompt injection, unsafe tool use, excessive autonomy and hallucinated output, with knowledge of practical safeguards.
• Secure development experience covering secrets handling, access control, input validation and auditability.
• Ability to take loosely defined problems through discovery, implementation, release and production support, and to understand, test and explain all code you deliver—including AI-assisted code.
• Ability to work onsite in Jersey City, New Jersey, three days per week.

Nice to Have

• Experience in financial services or another regulated industry, including audit, evidence and change-control requirements.
• Experience building software for security operations, IAM, PAM, cloud or network security, data protection or vulnerability management.
• Experience operating MCP servers for multiple consumers, including versioning, backwards compatibility and access governance.
• Experience with retrieval-augmented generation, including document ingestion, chunking, embeddings and vector search.
• Exposure to agent evaluation and LLM observability tools such as LangSmith, Langfuse, Arize Phoenix or Ragas.
• Experience with enterprise integrations using webhooks, event-driven patterns or workflow automation, and production observability through logging, metrics, tracing and alerting.
• Experience using AI coding assistants responsibly and collaborating with distributed teams across time zones.
• Open-source contributions, published research or conference speaking.