Product Engineer - Pipes & Vault
About the Role
The Pipes & Vault team builds the data infrastructure and agentic backbone of WorkOS. Vault is an encryption key management system (EKM) that encrypts and optionally stores sensitive objects using envelope encryption with HSM-backed keys, per-customer key segmentation, and Bring-Your-Own-Key support (AWS KMS, GCP KMS, Azure Key Vault, HashiCorp Vault). Pipes connects external data sources to apps and agents, while MCP Auth defines authority for agents to take action through integrations. This is a cutting-edge role at the intersection of security infrastructure and AI agent systems.
What You'll Do
- Design REST APIs for version-controlled encrypted objects and data encryption keys
- Build secure storage and key management systems with field-level encryption
- Implement key rotation, revocation, and per-customer cryptographic isolation
- Contribute to open-source specs (including MCP Auth for agent authorization)
- Prototype new developer tools and agentic workflows
- Build integrations that connect third-party data services to AI agent fleets
- Design audit and observability telemetry for key and object usage
- Lead internal R&D efforts leveraging Pipes & Vault in novel ways
What We Look For
- 5+ years of industry software development experience
- Experience with cryptography, key management, or security infrastructure
- Understanding of envelope encryption, HSMs, and secrets management patterns
- Experience with TypeScript, Node.js, and Postgres
- Familiarity with cloud KMS services (AWS KMS, GCP KMS, Azure Key Vault)
- Interest in AI agents, MCP, and building infrastructure for agentic workflows
- Experience in B2B SaaS or developer tools is a plus
- Familiarity with compliance requirements (SOC 2, GDPR data isolation) is a plus
About WorkOS
WorkOS provides the developer infrastructure behind modern enterprise-ready software. Their APIs power authentication, SSO, directory sync, and more for companies like OpenAI, Vercel, Cursor, Perplexity, and Webflow. The team is 100+ builders, remote-first across USA time zones. WorkOS raised $80M in Series B funding (led by Greenoaks, with Lightspeed Ventures and notable angels including Guillermo Rauch). Founded in 2020, they reached 200+ paying customers within two years.
Tech Stack
TypeScript, React, Node.js, Postgres, REST APIs with SDKs in Node.js, Ruby, Python, Go, PHP, Java, and .NET. Envelope encryption with HSM-backed keys.
Benefits
- Medical, dental, and vision insurance
- 401k with 3% employer match
- 20 days paid vacation
- 12 weeks parental leave
- Monthly fitness and wellness stipends
- Home office stipend
Work Style
Remote-first, USA time zones.