Software Engineer, Identity Platform

Role overview Design and build the identity foundation for a multi-tenant AI platform used by people, organizations, applications, and autonomous agents. The role covers authentication, authorization, enterprise provisioning, delegated access, and workload identity, while keeping access decisions explainable, secure, and fast on a critical request path.

Responsibilities - Unify API keys, browser sessions, OAuth/OIDC tokens, and other credentials under a consistent identity and authorization model; support MFA, passkeys, and enterprise single sign-on. - Build delegated access and consent flows so apps and agents can act for users with revocable, scoped permissions. - Enable CI systems, cloud workloads, and internal services to exchange trusted identity tokens for short-lived credentials without static secrets. - Develop server-enforced permissions for organizations and workspaces, including restricted roles and read-only automation access. - Implement enterprise provisioning with SCIM, group-to-role mapping, domain verification, and self-service identity-provider setup. - Define the core identity data model and add verification, fraud defenses, audit logs, and safeguards for sensitive access.

Requirements - 5+ years building production identity, authentication, or authorization systems for SaaS, developer platforms, or security products. - Deep knowledge of OAuth 2.x, OIDC, SAML, SCIM, and JWTs, including practical integration challenges. - Experience designing multi-tenant authorization models such as RBAC, ABAC, or ReBAC, and evolving live systems toward a unified model. - Hands-on enterprise identity-provider integrations and experience with an authentication platform. - Strong TypeScript and SQL skills, with experience in Postgres and low-latency services on critical request paths. - A security-focused approach to threat modeling and least privilege, plus the ability to explain decisions across technical and business teams.

Nice to have - Shipped enterprise SSO or SCIM, workload identity federation, or agent and MCP client delegation. - Experience with identity verification, fraud systems, fine-grained policy engines, or security compliance programs. - Familiarity with AI tooling.