Staff Software Engineer, Identity & Authorization

Highlights

• Design central authorization with typed principals and explainable decisions.
• Build token service for Agent delegation without broad long-lived credentials.
• Own identity systems protecting web, Agent, and enterprise interactions.

What they offer

• Competitive Salary & Equity
• 401(k) Program with a 4% match (US Only)
• Health, Dental, Vision and Life Insurance
• Short Term and Long Term Disability
• Paid Parental, Medical, Caregiver Leave
• Flexible Time Off (FTO) + Holidays
• Commuter Benefits (In-Office & US Only)
• Monthly Wellness Stipend
• Autonomous Work Environment
• In Office Set-Up Reimbursement (In-Office Only)
• Quarterly Team Gatherings
• In Office Amenities (In-Office Only)

Ideal candidate

Security-minded backend engineer who loves reasoning about delegation and least privilege. You thrive owning critical platform systems and making secure behavior simple for other teams.

Requirements

• Experience shipping and operating security-sensitive backend or distributed systems in production, including reliability, performance, incidents, and observability
• Depth in authentication, authorization, or identity systems, such as OAuth 2.0/OIDC, JWT, mTLS, Identity Federation, RBAC, ReBAC, PBAC, Zanzibar, Macaroons, Biscuits, Cedar, or policy engines
• Strong understanding of multi-tenant security, least privilege, delegation, privilege attenuation, auditability, and threat modeling
• Experience migrating security-sensitive systems without breaking callers, including typed contracts, shadow evaluation, and staged enforcement
• Fluent in at least one production backend stack
• Able to make and communicate tradeoffs across security, reliability, latency, product experience, delivery speed, and long-term maintainability