Senior Security Engineer

About the Company:

World is building a real human network designed to accelerate people in the age of AI. As bots and autonomous agents reshape the internet, people, institutions, and applications need a trusted way to confirm who is a real human while preserving privacy. Our products make this possible: the Orb verifies real people, World ID proves it privately, and World App enables and distributes the new applications made possible by this technology. Together, they form a new layer for AI internet.

We’re one of the fastest-growing networks in tech. More than 17 million people across 160 countries have verified with World ID, and we complete over 350,000 verifications each week. World App is already among the most used wallets globally. Developers are integrating World ID to build safer online experiences and create spaces where real people can participate, earn, and be recognized in ways AI simply can’t replicate.

World was founded in 2019 and launched globally in 2023. We are more than 400 people across hardware, software, AI, cryptography, mobile engineering, and global operations. Our teams come from OpenAI, Tesla, SpaceX, Apple, Google, Stripe, Meta, Coinbase, Palantir and MIT Media Lab. We’re backed by leading investors, including a16z, Khosla Ventures, Bain Capital Crypto, Blockchain Capital, Variant, Tiger Global, and Coinbase Ventures, as well as prominent operators and founders across fintech and AI.

World has been featured on the cover of TIME Magazine, highlighted in Fast Company’s Next 5 in Fintech, and explored in a Bloomberg deep dive. The New York Times, Bankless and TechCrunch have all recognized our progress in identity, cryptography, AI, and global-scale hardware deployment. Our leadership is also named to the Time AI 100. Learn more about the newest product launches from our Unwrapped event.

This opportunity is with Tools for Humanity.

About the Team:

Our multidisciplinary team’s mission is to detect & respond to attacks against the global-scale identity World ID service, which leverages a unique hardware device (the Orb), cloud-hosted APIs, mobile apps, and operations on the Ethereum blockchain to provide privacy-preserving “proof of human”. Together, we apply expertise in hardware, cloud infrastructure, application security, mobile devices, intrusion detection, machine learning/AI, blockchain, incident response, and more to solve these novel challenges.

We are building an entirely new automated detection and response system. Right now it needs to protect the 14 million+ verified World ID users processing millions of identity and financial transactions a day, and it will need to rapidly scale to protect billions of users using trusted and untrusted hardware, much of which we will not own. We will publish audit events to the public blockchain for the highest possible transparency and trust of the World ID system, and build decentralized detection & response using those logs. We need to do all this while maintaining the strongest possible privacy protections.

This team works closely with the teams building the core technologies (apps, orbs, network protocols, encryption designs, attestation, etc) because D&R and Privacy are foundational elements of the World Network.

About the Orb

World's launch requires a "Proof-of-Personhood": a way to determine someone is human (not a bot) and hasn't already claimed their free share of Worldcoin. This is why we developed the Orb.

The Orb is an advanced biometric imaging device, custom-designed for Worldcoin's launch. Orbs are deployed to a global network of operators, who use the device to onboard new World users. During this onboarding, the Orb generates an encoding of each user's iris and submits it to World's backend. For more details on how the Orb is part of World's privacy-preserving approach to Proof-of-Personhood, see the World whitepaper.

The Orb solves a fierce combination of engineering and UX challenges, centered around image quality, security, and ease-of-use. Each device has an advanced iris imaging system, designed to work consistently across real-world lighting conditions. An additional suite of sensors feeds into an onboard fraud detection system, enabling use in insecure environments. These systems are combined in a sleek industrial design with a simple, minimalist user interface.

About the Role:

You will work with our team of security experts and our device hardware & software teams to leverage the sensor features of a unique Linux-based hardware device (the Orb) to detect and respond to suspected tampering of the device, and for other threats, as a critical part of protecting the global-scale World ID identity service.

You will also be involved in designing (and implementing) tamper detections for our next identity verification device, nicknamed the “Orb Mini”.

Some travel (10-20% maximum) is expected, especially to our office in Munich, Germany where most of the Orb hardware and software teams are located.

About You

• 5-8 years experience designing and delivering security or tamper protection/detection for Linux-based hardware devices.

• Experience with simple electronics design and embedded programming

• Sound knowledge of cryptographic primitives (hashes, encryption) and public key infrastructure (signing operations, trust chains)

• Willing to participate in an oncall rotation and learn incident handling (or relevant experience)

• Strong critical thinking, communication, and leadership skills

• Comfort working cross-functionally with peer teams to negotiate and reach consensus solutions that improve security and privacy

• Energized by working in a fast-paced, collaborative environment

• If you don't think you meet all of the criteria but still are interested in the job, please apply. Nobody checks every box, and we're looking for someone excited to join the team.

Nice-to-Have Skills

• Ability to read and understand hardware designs from CAD, schematics and layouts

• Deep understanding of hardware-based security components and features (TPM, SE, secure boot, etc.) and attacks against them

• Experience executing or defending against physical and side-channel attacks against hardware devices and secure hardware components.

• By submitting your application, you consent to the processing and internal sharing of your CV within the company, in compliance with the GDPR.

Pay transparency statement (for CA based roles):

The reasonably estimated salary for this role at TFH ranges from $221,000 - $250,000 plus a competitive long term incentive package. Actual compensation is based on factors such as the candidate's skills, qualifications, and experience. In addition, TFH offers a wide range of best in class, comprehensive and inclusive employee benefits for this role including healthcare, dental, vision, 401(k) plan and match, life insurance, flexible time off, commuter benefits, professional development stipend and much more!