Rebecca Kukshtel

Software Engineer · Auth, Identity & AI Agent Security

Atlanta, GA · open to relocating to New York rebecca.kukshtel@gmail.com linkedin.com/in/rkukshtel rebeccakukshtel.com

Download PDF

Summary

Backend engineer with 11 years of experience, the last 5 building authorization and identity platforms at Netflix and Brex. Most recently helped ship Netflix's production guardrails for AI agents: a deny-only policy layer that narrows what agents can do and never grants access, enforcing ~1.8M decisions a day across ~1,000 services within a month of launch. I own high-traffic, globally distributed systems end to end, from design and migration through on-call, and I care about making secure access the easy, self-service path.

Experience

Netflix Senior Security Software Engineer (L5), Access Control Engineering

2024 – 2026

  • Core engineer on Netflix's authorization layer for AI agents, a deny-only Cedar policy service that restricts what agents can access. Led the Java, Go and Python clients, enforcement and fail-open/closed modes, and the multi-region rollout, scaling from pilot to ~1.8M enforced decisions/day across ~1,000 apps and ~1,100 agents in one month.
  • Added agent identity claims to the platform's auth context and built decision logging for agent access (Iceberg tables with schema provenance, sampling and a kill switch, CLI tooling, adoption dashboard) so security teams could audit agent behavior and track rollout.
  • Engineer on a globally distributed authorization platform making ~13B decisions/day across ~7,800 apps, evaluated locally in tens of microseconds. As release manager for the agent deployed beside every app, introduced containerized test infrastructure, performance baselines, canaried rollouts and an AI-assisted release gate.
  • Resolved a fleet-wide distributor failure from a production incident by designing a streaming gRPC API, eliminating message-size errors and CPU paging, and added retry-storm protection.
  • Led a live migration of a high-traffic access-management client onto the authorization platform, shadow-testing every call and cutting over behind feature flags.
  • Designed and launched a service that answers "who can access this?" across ~199k AWS IAM role policies by expanding group membership at scale (Java, Temporal). Replaced an hours-long daily scrape of ~6M authorization records with a real-time and batch export that completes in ~5 minutes.
  • Modeled observability cost for the platform, identifying ~$445k/yr in savings and driving a decision-log redesign; aligned the metric definition a company-level goal was measured against with the data science org.

Brex Senior Software Engineer

2021 – 2024

  • Designed a Kotlin authorization library (RBAC and PBAC) and drove adoption across 71 microservices through a paved-road "golden path," with P95 permission checks at 17ms.
  • Rebuilt the roles and access system and migrated off the legacy one at 99.99% availability, serving millions of calls a day at P95 18ms.
  • Shipped OAuth API token scoping, token exchange and revocation for the public Team API, documented at developer.brex.com.
  • Tech lead for customer-facing custom roles, partnering with Product and Design. Planned and led a phased caching rollout (sidecar, then centralized Redis) while mentoring 3 engineers.

Betterment Lead Software Engineer

2018 – 2021

  • Architected instant transfers for Cash Reserve and optimized cash and interest allocation across $100M+ in deposits.
  • Built the mobile Rewards & Referrals program, growing mobile-first signups 14%.

Earlier

2015 – 2017

ThoughtWorks, Developer Consultant (mobile and security in fintech) · NowThis Media, Backend Engineer

Skills

Identity & auth
OAuth 2.0, OIDC, SAML, SCIM, JWT, token exchange, SSO
Authorization
RBAC, ABAC/PBAC, fine-grained authorization (ReBAC), Cedar, policy-as-code, AWS IAM, least privilege
AI agents
Agent identity, non-human identity, agent guardrails, MCP, A2A, Claude Code
Distributed systems
Multi-region and global writers, replication, read replicas, sharding, load testing, canary and staged rollouts
Languages
Java, Go, Kotlin, Python, SQL; some TypeScript and Rust
Infrastructure
gRPC, REST, GraphQL, PostgreSQL, Redis, Temporal, Apache Iceberg, dbt, AWS

Education

  • Williams College, BA American Studies, cum laude
  • Georgia Tech, MS Computer Science (Machine Learning), incomplete: left in 2020 due to COVID-19, 4.0 GPA in completed courses
  • Bradfield School of Computer Science, architecture, operating systems, networking, distributed systems
  • Flatiron School, software engineering