[Hiring] Senior Principal Engineer - Agentic AI @Ditto

Role Description

AI agents are beginning to act on behalf of people and businesses—making decisions, transacting, and connecting to other systems on their own. The identity tools most organisations rely on today were built for people or predictable machine identities, not autonomous agents.

Ditto is investing in an agentic identity platform to address this. We're hiring a Senior Principal Engineer to help design and build it—hands-on—drawing on Ditto's heritage in identity, device binding, runtime protection and continuous authentication, and using large language models as a genuine force-multiplier for the research and the delivery.

In one line: own the design and hands-on build of the platform's hardest capabilities—verifiable agent identity, instance integrity, and continuous runtime trust—on a modern, standards-based foundation, moving at real pace.

Where You'll Make an Impact

• Help set the technical direction and architecture for the platform, and make sound build/buy calls under uncertainty.
• Integrate with existing enterprise identity providers and open standards rather than reinventing them, keeping external systems behind adapters so implementations can evolve as standards mature.
• Grow and mentor the team that scales the platform—a genuine principal-level remit.
• Engage the broader standards and security community to keep the work current, credible and interoperable.

What You'll Work With

• A fast-moving standards landscape, spanning agent & workload identity, authentication, delegation, attestation, continuous trust, agent interop, provenance and EU regulation.
• Agent & workload identity:
  • SPIFFE / SVID, workload identity, DID / VC, W3C agent identity work
• AuthN & credentials:
  • OAuth 2.1, OIDC, PKI, FIDO2 / WebAuthn, mTLS, sender-constrained tokens (DPoP)
• Delegation & authorization:
  • Token exchange (RFC 8693), on-behalf-of, CIBA, policy-based authorization
• Attestation & integrity:
  • Hardware attestation, TEEs (SEV-SNP, TDX, Nitro, Secure Enclave), RASP
• Continuous trust:
  • Shared Signals / CAEP, continuous & risk-based authentication
• Agent interop:
  • MCP, agent-to-agent protocols and the identity work around them
• Provenance:
  • Tamper-evident logs, software supply-chain attestation (SLSA / Sigstore)
• Regulatory (EU):
  • EU AI Act, eIDAS 2.0 / EUDI wallet, GDPR, DORA

You don't need every item on day one—but you should be fluent in identity and authorization fundamentals and able to reason from primary-source specs.

LLMs are core to how this role works, not a novelty: synthesizing fast-moving specs and vendor landscapes into build/buy decisions, driving threat models (OWASP NHI, Agentic Top 10) mapped to the property that defeats each attack, and accelerating delivery from spec to a working, demonstrable slice—always verified against primary sources, especially for crypto and security-critical logic.

Who You Are

• Builds evidence-first—shipping small, demonstrable increments and letting each one earn the next, rather than making big up-front bets.
• Reasons clearly from primary-source specs in a fast-moving, still-forming standards landscape.
• Uses LLMs deliberately and rigorously, and knows exactly where their output must be verified against primary sources.
• Is comfortable owning ambiguity at principal level—architecting and shipping, and mentoring a team along the way.

What We're Looking For

• Must-have:
  • 10+ years building production distributed systems, platform, or security infrastructure, with principal-level technical ownership—architecting and shipping, not only advising.
  • Deep identity & authorization expertise: OAuth 2.1 / OIDC, token exchange and on-behalf-of flows, sender-constrained tokens, PKI, FIDO2 / WebAuthn, mTLS, and workload identity.
  • Applied cryptography in practice: credential formats, binding proofs, key lifecycle and rotation, and clear reasoning about what a construction does and does not prove.
  • Hands-on depth in at least one differentiating area: hardware attestation / TEEs, RASP, or continuous / risk-based authentication and shared signals.
  • Demonstrated fluency leveraging LLMs for rigorous technical research and for building, with the judgement to verify output against primary sources.
  • Fluent English, spoken and written; based in Europe (EU / EEA) and able to work across European time zones with a mostly-overlapping team.
• Bonus Points:
  • Fluent or native Spanish, spoken and written—valuable across our Spanish-speaking European and LATAM customers and partners.
  • Experience with agent ecosystems and protocols (MCP, agent-to-agent) and the identity work around them.
  • Decentralised identity (DID / VC) and eIDAS 2.0 / EUDI wallet models.
  • EU regulatory fluency—EU AI Act, DORA, GDPR—and experience building audit and traceability in from day one.
  • Participation in standards bodies (e.g. IETF, OWASP) or relevant open-source contribution.

Why Join Ditto

A rare mandate to help define and build a category-shaping platform on an open, still-forming standards landscape—with principal-level ownership of architecture and technical direction, and a path to build and lead the team. You'll build on foundations Ditto has shipped for years in identity, device binding, runtime protection and continuous authentication, rather than starting from scratch.

We value ownership, curiosity and collaboration, giving our people the freedom to make decisions, challenge ideas and grow their careers while helping build the future of digital trust.