Job Description:Shape the Future of AI in Capital Markets and Legal Disclosure
At Toppan Merrill, we’re building Quinn, a cloud-based platform that helps law firms, investment banks, and public companies draft, review, and file SEC documents, including IPO registration statements, prospectuses, proxy statements, and annual and quarterly reports.
We’re applying AI to one of the most consequential document workflows in the world, where precision, trust, and accountability matter most. You’ll join a small, highly visible team, work directly with senior engineering leadership, and engage with some of the world’s largest law firms.
In this role, you’ll be the founding engineer for how outside AI tools such as Harvey and ChatGPT Enterprise securely connect to Quinn. That means production-ready OAuth 2.1 with token exchange, deny-by-default authorization, and a complete audit trail, built on the emerging Model Context Protocol standard and held to the security bar of the most demanding enterprise clients there are.
The first thing Quinn will pilot with clients is this integration. A working prototype already exists; turning it into a service a law firm’s security team will approve is the core of this role. You’ll build it and own it after launch.
What you will do
- Productionize the integration service (an MCP server) that outside AI tools connect to, over the Streamable HTTP transport
- Implement sign-in with OAuth 2.1 using our identity provider (Okta), including token exchange so the service calls Quinn on behalf of the attorney and never passes an outside tool’s token through
- Enforce what each outside tool may do: which actions its permissions allow, and which documents are on each client firm’s approved list, denying everything else by default
- Keep an immutable, exportable audit trail of every action an outside tool takes, including reads, that client firms can review
- Design controls for AI-specific risks, including tool misuse driven by content in documents and abnormal bulk access to documents
- Test with at least two external AI tools, and support client firms’ security reviews
- Build an internal command-line tool for our operations teams on the same service
How you’ll work
You’ll own the integration service end to end and partner closely with our Identity and Security teams on the authorization design and client security reviews. You’ll also work with a backend engineer building the matching controls inside the Quinn platform, and with the IT and innovation teams at our design partner law firms.
First 90 days
- Stand up the service with production sign-in in a test environment
- Implement the approved-document list and the audit log
- Connect a first external AI tool end to end
Required
- 6+ years of backend or platform engineering
- Deep, hands-on OAuth 2.0 or 2.1 and OIDC experience: authorization servers, scopes, audience, PKCE, token exchange
- Experience building services that external customers or partners integrate with, including security reviews
- Security-first engineering habits: deny by default, least privilege, audit logging
- Strong in TypeScript (Node.js) or Python, and comfortable working in the other; our services use both
- Experience integrating with customers’ identity providers (OIDC or SAML federation, multi-tenant SSO)
Preferred
- Model Context Protocol (MCP) servers, or AI tool and agent integrations
- Okta administration or custom authorization servers
- Experience integrating with enterprise legal software (document management systems, Harvey, or similar)
Success at 12 months
- Pilot running with design partner firms, having passed Toppan Merrill’s security review and each firm’s own
- Service passed an external penetration test with no open critical or high findings
- At least two different AI platforms connected
Learn more at https://www.toppanmerrill.com/careers/.
