Senior Python Engineer

Senior Python Engineer - Agent Runtimes & MCP Location: Remote, with at least five hours of daily overlap with US Central and UK working hours Duration: Initial six months; extension likely Role Overview First 90 Days — Key Focus Areas These are initial priorities, not a fixed backlog. Focus areas may evolve as new agentic commerce capabilities emerge. Set up the blueprint's verticals across Messages API, Agent SDK, and Managed Agents runtimes. Run test and verification suites and maintain fork compatibility. Integrate Agent Trust into StorefrontBackend and MerchantBackend, including session-start identity binding, cart and checkout trust checks, native result/error mapping, per-hook failure policies, PII-free decision logging, and outcome reporting. Build and test the storefront MCP server integration for Managed Agents behind an authenticating gateway, supporting vault credentials and signed identity claims. Develop an Experian MCP server with advisory tools and a companion skill for the commerce-builder Claude Code plugin. Write merchant integration guides and measure adoption effort through files changed, lines changed, prompt bytes, gates, and time to the first verified session. Implement OAuth token exchange under RFC 8693 with an enterprise identity provider, using audience-scoped downstream tokens without passing through the user's token. Embed trust verification into AWS-hosted agent runtimes, such as Bedrock worker agents or Lambda/ECS services, with enforcement in application code outside the model. Build a shopping-agent evaluation harness covering tool calls, purchase correctness, prompt injection, incorrect items, and overspending, with reproducible CI runs. Develop backend services for regulated financial-services use cases, including typed APIs, audit logging, permissible-use checks, and idempotent operations. Required Qualifications Five or more years building production Python microservices for modern SaaS backends. Strong experience with asyncio, typed Python, pytest, and ruff. API security experience covering OAuth 2.0 client credentials, on-behalf-of/token exchange flows, JWT issuance and verification, JWKS rotation and caching, and secrets handling. Microservices experience, including service-to-service authentication and structured error/result handling across service boundaries. Ability to reason about fail-open versus fail-closed behaviour within latency constraints. Ability to understand unfamiliar or unmaintained codebases quickly and support technical claims with module and line references. Ability to deliver independently from written acceptance criteria. Preferred Qualifications Production OAuth token exchange experience under RFC 8693, including audience validation, scope narrowing, and confused-deputy prevention. Production AWS experience with Lambda or ECS, IAM, and Secrets Manager. Experience shipping tool-using LLM agents through Claude Messages API or Agent SDK. Understanding of prompt caching and static-prefix requirements. Experience building or integrating authenticated MCP servers using streamable HTTP. Experience building or extending LLM evaluation harnesses. Familiarity with Claude Managed Agents, Claude Code plugins/skills, and Bedrock, Vertex, or Foundry routing. E-commerce experience covering carts, product variants, and checkout hand-off. Node.js 22 experience for example storefront integrations. Key Deliverables The agent-trust-commerce Python package, a Managed Agents gateway variant, an Experian MCP server, a commerce-builder companion skill, a merchant integration guide, and a retail demonstration. Travel Needs Occasional travel to partner or merchant sites may be required.