About the Team

KnowBe4's Platform Services group is the engineering backbone that the entire product organization runs on. We build the shared infrastructure, APIs, and frontend frameworks that power HRM+ and the growing suite of KnowBe4 products — so that every product team can ship faster, safer, and at scale.

As a Senior Software Engineer on the Core Engineering team, you'll work across the full stack: building Vue 3 micro-frontends, .NET Lambda APIs, and event-driven services on AWS. You'll collaborate closely with product, design, and the engineers shipping the HRM+ console and its integrations — tools that security and HR teams rely on to manage and protect their organizations.

We believe the best engineers own their work end-to-end. That means writing the API, shipping the UI, and wiring the infrastructure — and doing it in a way that the engineer who touches it next says, "this is well done."

What You'll Build

• Micro-frontend applications for HRM+ using Vue 3, TypeScript, and the single-spa framework — from shared navigation components to feature MFEs that compose into the HRM+ shell
• RESTful and GraphQL APIs deployed as AWS Lambda functions in C# (.NET 8/9), backed by DynamoDB, integrated with internal auth and identity services
• Event-driven services that process asynchronous workloads via SQS, including messaging integrations with Slack, Microsoft Teams, and Google Chat
• Shared frontend SDKs and component libraries consumed by multiple product teams — design-system-aligned, versioned, and published to internal NPM registries
• Infrastructure-as-Code using Terraform for multi-environment AWS deployments (dev, staging, production across multiple regions)
• CI/CD pipelines in GitLab CI that build, test, and deploy services to AWS via shared devex pipeline components

Education and Experience

• BS or equivalent plus 8 years of experience
• MS or equivalent plus 3 years of experience
• Ph.D. or equivalent plus 2 years of experience

Essential Responsibilities

• Develops software using the KnowBe4 Software Development Lifecycle and Agile Methodologies
• Recommends solutions to engineering problems
• Assists other team members by providing technical direction
• Defines approaches and solutions to complex technical problems
• Helps to translate KnowBe4's strategic goals into operational plans
• Provides coordination across functional boundaries
• May act as team lead for sub-projects

Technical Requirements

Required

• TypeScript — production experience building and maintaining typed TypeScript applications
• Vue 3 — Composition API, component design, reactivity model, testing with Vitest
• C# / .NET (8+) — building APIs with ASP.NET Core deployed as AWS Lambda functions
• AWS Serverless — Lambda, DynamoDB, SQS, S3, CloudFront, API Gateway, SSM Parameter Store
• REST API design — resource modeling, versioning, error handling, API contracts
• Terraform — writing and maintaining infrastructure-as-code for cloud resources
• GitLab CI/CD — writing pipelines, using shared CI components, multi-environment deployments
• Strong fundamentals — data structures, distributed systems, testing strategies, code review

Preferred / Nice-to-Have

• Micro-frontend architecture — experience with single-spa, module federation, or similar MFE patterns
• Rust — production or personal project experience; strongly encouraged, can be learned on the job
• GraphQL — schema design, resolvers, client-side queries
• Python — scripting or service development, particularly for Lambda or event processing
• Auth/Identity concepts — OIDC, OAuth 2.0, JWT, SSO; understanding of auth flows even without deep implementation experience
• Auth0 or Keycloak — configuration or integration experience
• Vite, pnpm — modern frontend toolchain familiarity
• LocalStack — local AWS service emulation for development and testing
• Contract testing — consumer-driven API contract testing between services (e.g., Pact or equivalent)

As a Snr. Data Analyst at KnowBe4's Threat Labs, you'll conduct hands-on analysis of real-world email-based cyber threats by investigating suspicious emails to identify phishing, malware, and social engineering attacks, extracting indicators of compromise (IOCs) like URLs, domains, and file hashes, tracking ongoing threat campaigns using OSINT tools and mapping them to MITRE ATT&CK frameworks, and contributing technical research blogs and intelligence documentation that helps protect users globally—all while working alongside experienced security researchers in a collaborative environment using industry-standard tools like VirusTotal, URLscan.io, and Python scripting to turn raw threat data into actionable cybersecurity intelligence

Responsibilities:

• Manual Threat Analysis: Investigate and classify suspicious emails to identify phishing, malware, spam, and benign attempts from real-world attack scenarios using our internal tooling.
• IOC Extraction: Extract and document Indicators of Compromise—URLs, domains, file hashes, sender information—from email headers, body content, and attachments.
• Campaign Tracking: Research and monitor ongoing email-based threat campaigns, mapping attacker tactics, techniques, and procedures (TTPs) to MITRE ATT&CK.
•  Intelligence Contribution: Build and maintain internal threat intelligence datasets, detection patterns, and research documentation.
• Collaboration: Partner with senior researchers and participate in threat reviews to share observations and enhance detection quality.
• Growth: Keep learning! Share discoveries, explore new analysis techniques, and raise the bar for the team.

Requirements:

• Educational Background: A university degree is not required. We actively encourage applications from individuals with vocational IT training, technical diplomas, relevant certifications (e.g., CompTIA IT Fundamentals), or those returning to the workforce who possess strong digital literacy.
• 3 years experience in the field
• An understanding of common cybersecurity threats (e.g., domain spoofing, spear-phishing)
• Exceptional attention to detail and the stamina to maintain focus during highly repetitive analytical tasks
• Experience handling large datasets

As a Snr. Email Security Analyst at KnowBe4's Threat Labs, you'll conduct hands-on analysis of real-world email-based cyber threats by investigating suspicious emails to identify phishing, malware, and social engineering attacks, extracting indicators of compromise (IOCs) like URLs, domains, and file hashes, tracking ongoing threat campaigns using OSINT tools and mapping them to MITRE ATT&CK frameworks, and contributing technical research blogs and intelligence documentation that helps protect users globally—all while working alongside experienced security researchers in a collaborative environment using industry-standard tools like VirusTotal, URLscan.io, and Python scripting to turn raw threat data into actionable cybersecurity intelligence

Responsibilities:

• Manual Threat Analysis: Investigate and classify suspicious emails to identify phishing, malware, spam, and benign attempts from real-world attack scenarios using our internal tooling.
• IOC Extraction: Extract and document Indicators of Compromise—URLs, domains, file hashes, sender information—from email headers, body content, and attachments.
• Campaign Tracking: Research and monitor ongoing email-based threat campaigns, mapping attacker tactics, techniques, and procedures (TTPs) to MITRE ATT&CK.
•  Intelligence Contribution: Build and maintain internal threat intelligence datasets, detection patterns, and research documentation.
• Collaboration: Partner with senior researchers and participate in threat reviews to share observations and enhance detection quality.
• Growth: Keep learning! Share discoveries, explore new analysis techniques, and raise the bar for the team.

Requirements:

• Educational Background: A university degree is not required. We actively encourage applications from individuals with vocational IT training, technical diplomas, relevant certifications (e.g., CompTIA IT Fundamentals), or those returning to the workforce who possess strong digital literacy.
• 3 years experience in the field
• An understanding of common cybersecurity threats (e.g., domain spoofing, spear-phishing)
• Exceptional attention to detail and the stamina to maintain focus during highly repetitive analytical tasks
• Experience handling large datasets

Role Summary
KnowBe4's Platform Services group builds the infrastructure that every product team depends on. At the Staff level, you're not just contributing to that foundation — you're shaping it. You'll work at the intersection of identity, platform reliability, and developer experience, solving problems that have direct impact on every engineer and every customer at KnowBe4.

The identity and auth platform you'll help lead underpins session management, single sign-on, user provisioning, and cross-product authorization for the entire KnowBe4 product suite. The decisions made here ripple across every engineering team at KnowBe4 and the end-user sessions of a global customer base. We need engineers who can think at that scale, communicate across organizational boundaries, and write production-quality code — not just direct others to.

This is a technical individual contributor role. You'll lead through your engineering, your judgment, and your ability to bring others along with you.

What You'll Build

• Session and identity APIs in Rust deployed as AWS Lambda functions — high-throughput, low-latency services handling JWT validation, session lifecycle, and encrypted token management across multiple AWS regions
• Identity provider integrations — orchestration and configuration of Auth0 and Keycloak tenants, IDP sync services, and SSO/OIDC broker logic that spans legacy and modern auth systems
• User provisioning and lifecycle services — the USPS (User Provisioning Service) and UPMS (User Permission Management Service) layers that synchronize user state across products, CRM systems, and identity stores
• Cross-team platform SDKs — auth libraries in Rust, C#, and TypeScript consumed by multiple engineering teams; these are the APIs that teams depend on, so design quality and backward compatibility matter deeply
• Distributed event infrastructure — DFS (Distributed Feedback Service) subscribers, SQS-based event pipelines, and the message routing layer that coordinates state changes across bounded contexts
• Infrastructure-as-Code at scale — multi-account, multi-region Terraform that provisions and governs the identity and platform layer across development, staging, and production environments
• Technical direction — architecture reviews, RFC-style design proposals, mentorship of senior engineers, and cross-team coordination on platform-level changes

Essential Responsibilities

• Develops software using the KnowBe4 Software Development Lifecycle and Agile Methodologies
• Assists other team members by providing technical direction
• Defines approaches and solutions to complex technical problems
• Makes significant contributions in new technology, sometimes resulting in patents, trade secrets, and/or professional publications and presentations
• Translates KnowBe4's strategic goals into operational plans
• Provides coordination across functional boundaries
• May act as team lead for larger sub-projects or entire, small projects

Skills Requirements

• Strong backend engineering fundamentals in a typed, compiled language — Rust, C#, Go, Java, or equivalent; depth in one, curiosity about others
• AWS serverless architecture — Lambda (multi-runtime), DynamoDB, SQS, SSM, API Gateway, IAM; experience designing systems, not just using them
• Identity and auth concepts — OIDC, OAuth 2.0, JWT, SSO; you understand the flows, the attack surfaces, and the tradeoffs; deep implementation experience is a strong plus
• Distributed systems design — event-driven architecture, eventual consistency, message queues, idempotency, saga patterns
• Terraform at scale — multi-account, multi-region IaC; module design, state management, OIDC-based CI deploy patterns
• API design leadership — designing APIs consumed by multiple teams; versioning strategy, backward compatibility, contract testing
• GitLab CI/CD — pipeline design, shared components, multi-environment deployment patterns
• Technical communication — design docs, RFCs, architecture reviews; ability to synthesize complexity into clear proposals

Preferred / Nice-to-Have

• Rust — production experience is a strong differentiator; familiarity with the async ecosystem (tokio, axum, reqwest, serde) particularly valued
• C# / .NET (8+) — Lambda AOT compilation, ASP.NET Core, Native AOT targeting linux-arm64
• Auth0 — tenant administration, custom actions, SAML/OIDC/OAuth app configuration, Management API
• Keycloak — realm configuration, custom providers, integration with external IDPs
• TypeScript + Vue 3 — the platform layer includes frontend surfaces; full-stack comfort is valued even at the Staff level
• Python — event-processing services and tooling in this layer use Python
• Security engineering concepts — threat modeling, zero-trust principles, secrets management, credential rotation

Education & Experience

• BS or equivalent plus 10 years of experience
• MS or equivalent plus 5 years of experience
• Ph.D. or equivalent plus 4 years of experience 

As a Data Analyst at KnowBe4's Threat Labs, you'll conduct hands-on analysis of real-world email-based cyber threats by investigating suspicious emails to identify phishing, malware, and social engineering attacks, extracting indicators of compromise (IOCs) like URLs, domains, and file hashes, tracking ongoing threat campaigns using OSINT tools and mapping them to MITRE ATT&CK frameworks, and contributing technical research blogs and intelligence documentation that helps protect users globally—all while working alongside experienced security researchers in a collaborative environment using industry-standard tools like VirusTotal, URLscan.io, and Python scripting to turn raw threat data into actionable cybersecurity intelligence

Responsibilities:

• Manual Threat Analysis: Investigate and classify suspicious emails to identify phishing, malware, spam, and benign attempts from real-world attack scenarios using our internal tooling.
• IOC Extraction: Extract and document Indicators of Compromise—URLs, domains, file hashes, sender information—from email headers, body content, and attachments.
• Campaign Tracking: Research and monitor ongoing email-based threat campaigns, mapping attacker tactics, techniques, and procedures (TTPs) to MITRE ATT&CK.
• Intelligence Contribution: Build and maintain internal threat intelligence datasets, detection patterns, and research documentation.
• Collaboration: Partner with senior researchers and participate in threat reviews to share observations and enhance detection quality.
• Growth: Keep learning! Share discoveries, explore new analysis techniques, and raise the bar for the team.

Requirements:

• Educational Background: A university degree is not required. We actively encourage applications from individuals with vocational IT training, technical diplomas, relevant certifications (e.g., CompTIA IT Fundamentals), or those returning to the workforce who possess strong digital literacy.
• 1-2 years experience in the field
• An understanding of common cybersecurity threats (e.g., domain spoofing, spear-phishing)
• Exceptional attention to detail and the stamina to maintain focus during highly repetitive analytical tasks
• Experience handling large datasets

As an Email Security Analyst at KnowBe4's Threat Labs, you'll conduct hands-on analysis of real-world email-based cyber threats by investigating suspicious emails to identify phishing, malware, and social engineering attacks, extracting indicators of compromise (IOCs) like URLs, domains, and file hashes, tracking ongoing threat campaigns using OSINT tools and mapping them to MITRE ATT&CK frameworks, and contributing technical research blogs and intelligence documentation that helps protect users globally—all while working alongside experienced security researchers in a collaborative environment using industry-standard tools like VirusTotal, URLscan.io, and Python scripting to turn raw threat data into actionable cybersecurity intelligence

Responsibilities:

• Manual Threat Analysis: Investigate and classify suspicious emails to identify phishing, malware, spam, and benign attempts from real-world attack scenarios using our internal tooling.
• IOC Extraction: Extract and document Indicators of Compromise—URLs, domains, file hashes, sender information—from email headers, body content, and attachments.
• Campaign Tracking: Research and monitor ongoing email-based threat campaigns, mapping attacker tactics, techniques, and procedures (TTPs) to MITRE ATT&CK.
• Intelligence Contribution: Build and maintain internal threat intelligence datasets, detection patterns, and research documentation.
• Collaboration: Partner with senior researchers and participate in threat reviews to share observations and enhance detection quality.
• Growth: Keep learning! Share discoveries, explore new analysis techniques, and raise the bar for the team.

Requirements:

• Educational Background: A university degree is not required. We actively encourage applications from individuals with vocational IT training, technical diplomas, relevant certifications (e.g., CompTIA IT Fundamentals), or those returning to the workforce who possess strong digital literacy.
• 1-2 years experience in the field
• An understanding of common cybersecurity threats (e.g., domain spoofing, spear-phishing)
• Exceptional attention to detail and the stamina to maintain focus during highly repetitive analytical tasks
• Experience handling large datasets