Identity Engineer

Location: Columbus, OH (in-person preferred, hybrid possible for the right person)

\n

\n

Full-time · Early stage, backed by Drive Capital

\n

\n

Base: $130,000 to $170,000 + potential early-team equity + 100% paid entire-family medical, dental, vision, and life insurance.

\n

\n

About Us

\n

\n

Blacklight is a network that knows and verifies who, or what, is on it. Every machine, AI agent, and person gets a built-in, unforgeable identity, with security baked into the network itself.

\n

\n

We are a small, early-stage company backed by Drive Capital. We are quiet about product specifics right now and will share more as conversations progress. What we can say up front is the shape of the problem.

\n

\n

Almost every system in use today authenticates a connection. Very few authenticate the thing on the other end in a way that holds up to scrutiny after the fact. That was a tolerable gap when the things on the other end were people. It is a serious one now that they are also services, devices, and AI agents acting with real authority.

\n

\n

We are building identity infrastructure where an enrolled human, agent, device, or service is cryptographically attributable before it is allowed to act.

\n

\n

Why This Role

\n

\n

You would be the first identity hire, working directly with the CTO and the founding team. There is no legacy system, no accumulated compromise, and no committee. There is also nowhere to hide, which is the honest version of the pitch.

\n

\n

What You Will Own

\n

\n

- The certificate authority. Root and intermediate design, offline root custody, issuance policy, rotation, revocation, and a recovery path that actually works when someone tries it at 2am.

\n

- Enrollment lifecycles that keep sponsor, human, agent, device, service, and network authorization as distinct concepts rather than collapsing them into one blurry credential.

\n

- Making every protected path attributable to an enrolled identity, with explicit authorization, expiration, revocation, and evidence an auditor can read.

\n

- Key custody design that keeps long-lived private keys out of application and agent reasoning environments while preserving an operable break-glass path.

\n

- Backup, escrow, and cleanroom recovery practices, plus your part of incident response.

\n

- The runbooks, decision records, and reproducible tests that turn all of the above from a design into a system someone else can operate.

\n

\n

What We Need

\n

\n

- You have designed and operated a certificate authority in production, including the unglamorous parts: rotation, revocation, escrow, and recovery.

\n

- Working fluency in mTLS, X.509, and certificate enrollment protocols. You know where the standards are silent and what people do about it.

\n

- Real experience with modern authentication and identity standards: FIDO/WebAuthn, OAuth 2.0, OpenID Connect. You can explain the failure modes, not just the flows.

\n

- Sound judgment on cryptographic keys, credential custody, access control, and auditability. You back security claims with tests and observable evidence rather than assertion.

\n

- You have run production Linux and container infrastructure, and you translate designs into reviewable configuration, automation, and tests.

\n

- You have been on call for something you built. Ideally for a CA, identity, or network incident.

\n

\n

Strong Plus

\n

\n

- SPIFFE/SPIRE, workload identity, or WIMSE.

\n

- NIST SP 800-207 (zero trust architecture) and SP 800-63 (digital identity guidelines).

\n

- Hardware-backed keys: TPMs, HSMs, secure enclaves, or mobile/eSIM/eUICC identity.

\n

- Nostr, secp256k1, or other signed-event cryptographic identity systems.

\n

- Secure device enrollment, transparent egress controls, or privacy-preserving telemetry.

\n

\n

How We Work

\n

\n

We use AI agents heavily in our own engineering. We expect you to direct and review agent output productively, and to design controls that do not depend on agents behaving perfectly. Skepticism about agents is welcome. Refusal to work alongside them is not.

\n

\n

We start with small, testable systems, document their limits honestly, and evolve them. Temporary shortcuts get a written expiration date.

\n

\n

You write clear decision records and runbooks. You are comfortable learning adjacent domains quickly.

\n

\n

Compensation

\n

\n

Base: $130,000 to $170,000, plus potential meaningful early-team equity.

\n

\n

We pay 100% of a top-tier medical, dental, and vision plan for you and your dependents. Not a percentage, not employee-only, not a high-deductible plan we picked because it was cheap. Full coverage for your whole family. We also offer a 401(k).

\n

\n

That benefit is worth real money and we mention it up front because most postings bury it. If you have a family, run the math against what you are paying today before comparing base numbers.

\n

\n

Process

\n

\n

1. 30-minute conversation with our COO and CTO.

\n

2. 60-minute technical conversation with our CTO.

\n

3. A paid half-day design exercise on a real problem, reviewed by the founding team.

\n

4. References and offer.

\n

\n

We aim to go start to finish in under three weeks.

\n

\n

How to Apply

\n

\n

Email careers@blacklight.network with the subject line Identity Engineer. Send a resume or a link to your work. If you want to add a few sentences, tell us about a system you built or operated where identity was the hard part, and what broke.

\n

\n

We read every application and we reply.

\n

\n

\n

Blacklight Network is an equal opportunity employer. We evaluate every applicant on merit and do not discriminate on the basis of race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, veteran status, genetic information, or any other characteristic protected by federal, state, or local law. If you need an accommodation at any point in the process, tell us and we will work with you.

\n

\n

Applicants must be authorized to work in the United States. We are not able to sponsor or transfer employment visas at this time.

\n