Black Duck Software, Inc. helps organizations build secure, high-quality software, minimizing risks while maximizing speed and productivity. Black Duck, a recognized pioneer in application security, provides SAST, SCA, and DAST solutions that enable teams to quickly find and fix vulnerabilities and defects in proprietary code, open source components, and application behavior. With a combination of industry-leading tools, services, and expertise, only Black Duck helps organizations maximize security and quality in DevSecOps and throughout the software development life cycle.
Principal Software Engineer, Agentic Integrations
Location: Calgary, Alberta
Black Duck Software, Inc. helps organizations build secure, high-quality software, minimizing risks while maximizing speed and productivity. Black Duck, a recognized pioneer in application security, provides SAST, SCA, and DAST solutions that enable teams to quickly find and fix vulnerabilities and defects in proprietary code, open source components, and application behavior. With a combination of industry-leading tools, services, and expertise, only Black Duck helps organizations maximize security and quality in DevSecOps and throughout the software development life cycle.
Role Overview
The Integrations team is looking for a Principal Software Engineer who can architect — not just implement — the agentic workflows that connect Black Duck's application security products (SAST, SCA, and DAST) directly into the developer's agentic workflow. This role is less about general programming depth and more about the hands-on experience needed to design and harden production-grade AI agent systems — multi-agent orchestration, tool use, and MCP-based integrations — that AI coding agents, IDEs, and orchestration frameworks can consume natively, extending work already underway on projects like the Black Duck MCP Gateway and SAST AI Fix Recommendation.
This is a hands-on, senior technical role built for someone who takes initiative. We're looking for an engineer who doesn't wait to be told what to build — who spots gaps in how our products show up in the agentic developer workflow, proposes a direction, and drives it to production. You'll be setting the architecture and technical direction — not just executing against a spec — for how Black Duck shows up inside the tools developers already use — from IDEs to CI/CD to PR workflows — while partnering closely with Product and Applied AI teams shaping the company's broader agentic strategy.
Key Responsibilities
- Own the "big picture" solution architecture for the integrations team — designing and hardening how agentic workflows, MCP surfaces, and multi-agent orchestration patterns (task decomposition, tool use, agent hand-off, frameworks such as Pydantic AI, LangChain, and LangGraph) fit together as a coherent system across IDEs, CI/CD, and pull request workflows. This is the core capability the role exists to fill, more so than general programming depth on its own.
- Identify new opportunities to bring Black Duck's capabilities into agentic developer and CI workflows, and take the initiative to prototype, pitch, and build them — this role is as much about proposing what we should build next as executing on what's already defined
- Design, build, and implement agentic workflows and integrations — spanning agents, skills, MCP-based tooling, and APIs — that bring Black Duck's AppSec products (SAST, SCA, DAST) into developer tooling, with strong attention to governance, permissions, and auditability
- Own the technical direction and continued development of the Black Duck MCP Gateway, expanding the surface area of tools and capabilities it exposes to AI agents and IDEs
- Contribute and evolve existing agentic capabilities such as SAST AI Fix Recommendation, improving remediation guidance and automated fix generation for developers
- Mentor engineers on agentic system design and modern integration patterns
Required Qualifications
- Hands-on experience building agentic AI systems — multi-agent orchestration, tool use, task decomposition (e.g., LangChain, PydanticAI, LangGraph, or equivalent)
- Experience building or integrating Model Context Protocol (MCP) servers, or comparable plugin/tool architectures in AI assistants, IDEs, and CI/CD workflows
- 2+ years hands-on experience applying LLMs into production workflows — prompt engineering, RAG pipelines, API-based model integration, agent eval frameworks — with real examples, not just prototypes
- Strong API and systems design skills — experience shipping integrations, SDKs, reusable connectors, or canonical models consumed across systems of record and by external developers
- Experience with CI/CD, Git workflows, and modern developer tooling
- A demonstrated track record of taking initiative and owning technical projects end-to-end — identifying opportunities, proposing solutions, and driving delivery from design through production with minimal oversight
- Strong cross-functional communication skills — comfortable working across Product, Applied AI, and platform engineering
- Broad, well-rounded software engineering background (8+ years) — Python, TypeScript/JavaScript, Go, APIs, distributed systems, and modern SCMs (GitLab, GitHub, Bitbucket, Azure)
Preferred (Nice to Have)
- Experience in Application Security (SAST, SCA, DAST, ASPM) or DevSecOps tooling
- Experience with AI-assisted development tools (GitHub Copilot, Claude Code, Cursor, or similar)
- Deep technical depth in LLM integration — vector databases/retrieval pipelines (Pinecone, Weaviate, ChromaDB, Qdrant, pgvector), function calling/tool use, and structured output parsing
- Experience publishing and maintaining developer-facing packages (npm, PyPI, etc.)
- Background contributing to open-source developer tooling or SDKs
Black Duck is an equal opportunity employer. We consider all applicants for employment without regard to race, color, national origin, religion, sex, gender identity or expression, age, disability, sexual orientation, veteran or military service status, or any other characteristic protected by applicable law. Black Duck complies with all applicable laws prohibiting employment discrimination in every jurisdiction where it operates and provides reasonable accommodations to individuals with disabilities in accordance with applicable law.
Skills Required
- Hands-on experience building agentic AI systems including multi-agent orchestration, tool use, and task decomposition (e.g., LangChain, PydanticAI, LangGraph)
- Experience building or integrating Model Context Protocol (MCP) servers or comparable plugin/tool architectures in AI assistants, IDEs, or CI/CD workflows
- 2+ years hands-on experience applying LLMs into production workflows (prompt engineering, RAG pipelines, API-based model integration, agent eval frameworks)
- Strong API and systems design skills; experience shipping integrations, SDKs, reusable connectors, or canonical models
- Experience with CI/CD, Git workflows, and modern developer tooling
- Demonstrated track record of owning technical projects end-to-end with minimal oversight
- Strong cross-functional communication skills
- Broad software engineering background (8+ years) with Python, TypeScript/JavaScript, Go, distributed systems, APIs, and modern SCMs (GitLab, GitHub, Bitbucket, Azure)
- Experience in Application Security (SAST, SCA, DAST) or DevSecOps tooling
- Experience with AI-assisted development tools (GitHub Copilot, Claude Code, Cursor, or similar)
- Deep technical experience in LLM integration: vector DBs/retrieval pipelines (Pinecone, Weaviate, ChromaDB, Qdrant, pgvector), function calling, structured output parsing
- Experience publishing and maintaining developer-facing packages (npm, PyPI)
- Background contributing to open-source developer tooling or SDKs
Black Duck Compensation & Benefits Highlights
The following summarizes recurring compensation and benefits themes identified from responses generated by popular LLMs to common candidate questions about Black Duck and has not been reviewed or approved by Black Duck.
-
Healthcare Strength — Medical, dental, and vision coverage provide multiple plan choices with transparent costs, with carrier updates noted for 2026. Vision via VSP and dental plan options offer defined tiers and network access.
-
Retirement Support — Retirement programs include a 401(k) with company matching alongside an employee stock purchase plan with a discount and lookback. These features support longer‑term savings and wealth building.
-
Leave & Time Off Breadth — Exempt employees use a manager‑approved, no‑cap time‑off model, while non‑exempt employees accrue flexible time off alongside sick time. Paid leaves include parental and family care leave, with additional protections under applicable leave laws.
Black Duck Insights
What We Do
Organizations worldwide use Black Duck Software’s industry-leading products to secure and manage open source software, eliminating the pain related to security vulnerabilities, compliance and operational risk. Black Duck is headquartered in Burlington, MA, and has offices in San Jose, London, Frankfurt, Hong Kong, Tokyo, Vancouver, Seoul & Beijing
Why Work With Us
We pride ourselves on cultivating an environment of collaboration, creativity, and fun! We know where you work can influence how you work, which is why our collaborative office space focuses on community and continuous learning. Our work-hard, play-hard attitude even got us named a Top Place to Work in Massachusetts by The Boston Globe!
Gallery
.png)
