Staff Software Engineer, Identity and Authorization

Role overview

Set the technical direction for a centralized identity and authorization platform used by enterprise and public-sector customers. You’ll shape a reusable, relationship-based permissions model, strengthen its production readiness, and guide migrations from legacy access checks while helping other engineering teams build on the platform.

Responsibilities

- Design fine-grained authorization capabilities and reusable interfaces that support consistent permission decisions across services. - Guide the evolution of the authorization architecture, including migration sequencing, legacy access retirement, and improved group and organizational models. - Improve reliability, security, and scalability for production workloads, including cloud workload identity integrations. - Lead design reviews, explain architectural decisions, unblock engineers, and establish patterns other teams can adopt. - Reduce technical debt and improve delivery practices, including responsible use of AI-assisted coding tools.

Requirements

- Experience evolving enterprise authorization systems under production traffic and designing systems that scale for large customers. - Hands-on knowledge of fine-grained or relationship-based authorization, including schema design and tradeoffs with role-based access control. - Strong understanding of OIDC and SAML; familiarity with identity providers such as Keycloak, Auth0, Okta, or ForgeRock is useful. - Backend engineering expertise in Go, Java, or a comparable language, with experience running services on Kubernetes and designing APIs for platform users. - Practical experience with cloud workload identity, such as AWS IRSA, Azure Workload Identity, or GCP Workload Identity Federation. - A record of improving engineering quality and helping teams make sound design decisions; real-world use of AI coding tools with attention to security and code quality.

Nice to have

- Experience designing a new authorization system and migrating from a legacy approach, working on a platform team, or building identity and access products. - Familiarity with secrets management systems such as Vault.

Benefits and work setup

- Remote role. The listed annual US base salary range is $200,000–$235,000, with potential additional equity, bonuses, retirement, health coverage, and wellness benefits.