Security Engineer

About Kenn

Kenn is a venture-backed startup building next-generation systems to power the future of agentic work. Wes McKinney, Phillip Cloud, and Marius van Niekerk founded it in 2026. Before Kenn, Wes created pandas and co-created Apache Arrow.

kenn.io · github.com/kenn-io

The role

Kenn is hiring a security engineer. You will own security for all of Kenn: the product our customers use, the company, and the machines and AI agents we build with.

You will keep Kenn ahead of supply-chain attacks, AI coding agents that go rogue, and credential theft.

This is a senior role. Kenn is a small team, and no one will report to you at first. You will work directly with the founders, and like everyone at Kenn, you will ship code.

What you will do

This work keeps going, because the product, the team, and the agents we use keep changing. Here is the kind of work we mean.

Make agents safe to build with

• You set the company's strategy for building safely with agents: which agents we use, what they can reach, and what they may do without a person checking.
• You decide where code that agents write runs, and what it can touch when it goes wrong.
• Someone asks why an agent made a change. You can show who started the agent, what it was asked to do, and whose credentials it used.
• You decide what access an agent gets for a task, how long that access lasts, and what happens when the agent misbehaves.
• The team wants to try a new agent tool. You work out what it can reach and how to let people use it safely.

Attack our own work first

• You are our in-house attacker. You use AI to try to break into our products, tools, open-source projects, internal and public services, cloud infrastructure, and websites before an adversary does, and you keep doing it as we ship.
• You build or adapt the agent tooling that runs those audits, so they happen continuously.

Secure the product

• You review new product features with the engineers building them, and find the security problems before customers do.
• A customer's security team wants to know how we protect their data. You explain it, and you follow through on what they ask for.

Lock down the company

• A new hire signs in once on their first day and has the access their role needs. When someone leaves, their access ends that day.
• A package we depend on is compromised. Within hours you know whether we pulled the bad version, where it ran, and what it could reach, and you ship patched releases of anything of ours that included it.
• You design new cloud systems with the people building them, so they are secure from the start.

Respond and comply

• A vulnerability is published that affects software we ship. You cut a patched release quickly and get it out on every channel people install our open-source projects from.
• You automate how we vet and publish patch releases.
• You are on call for security incidents. When something looks wrong at 2am, you have the logs to tell what happened, a plan for what to do next, and a written account of it afterward.
• You run our SOC 2 program and its audits.

What you will build

You will build tools that let agents run code on our systems without putting those systems at risk, and that tell us what an agent did and why. We want the secure way to be the easy way: sign-in that just works, access that people can request and get quickly, and defaults that keep new repositories and services safe without anyone having to think about it.

You will do this work with agents. Much of security operations is repetitive: reviewing access, triaging alerts, collecting audit evidence, and drafting questionnaire answers. Hand what you can to agents, and keep improving them.

Who we are looking for

• Engineer first. You write and ship code; the language matters less than what you have built.
• Hands-on with infrastructure. You have built and run production infrastructure, and you can design systems that are hard to break into.
• Knows the fundamentals. Secret handling, least privilege, and short-lived credentials are second nature to you.
• Makes security easy to use. When you close an unsafe path, you open a safe one that people want to take.
• Builds with agents. You use AI coding agents every day, and you have opinions about how to keep them safe.

Nice to have: experience taking a company through a SOC 2 audit.

Why join

You will decide how Kenn secures agents that run code and act for people, for our own team and for our customers.

The scope is wide. You own security for the product, our open-source projects, our infrastructure, and the company, and you get to attack all of it with AI.

You will work directly with the founders on a small team where everyone ships code. Security here is engineering work: you build the tools and defaults the rest of us use every day.