Staff Software Engineer, Identity and Authorization

Accountabilities: Define and lead the technical architecture for identity and authorization services, building a centralized, fine-grained, relationship-based authorization framework using SpiceDB and reusable permission primitives. Evolve enterprise authorization capabilities to support complex user, group, resource, and organizational relationships while replacing fragmented, feature-specific permission checks with consistent platform-wide patterns. Strengthen the production readiness of authorization services by addressing scalability, reliability, performance, security, and operational requirements for enterprise and public-sector customers. Plan and execute the migration from legacy access control mechanisms to the centralized authorization framework, making sound architectural decisions that minimize disruption and preserve customer trust. Design improved group and organizational hierarchy models that reflect complex enterprise structures and support flexible, accurate access management. Expand cloud-native identity capabilities by integrating workload identity patterns, starting with AWS IAM Roles for Service Accounts (IRSA) and extending support to Azure and Google Cloud Platform equivalents. Establish clean APIs, flexible abstractions, and reusable identity capabilities that enable other engineering teams to integrate authorization into their services effectively. Serve as a technical authority for identity and authorization, guiding architectural decisions, clarifying complex trade-offs, and helping engineers resolve challenging design and implementation issues. Lead design reviews, improve engineering standards, reduce technical debt, and promote maintainable solutions that increase development velocity while minimizing ongoing operational effort. Develop and promote responsible AI-assisted engineering practices that accelerate implementation and testing while preserving security, correctness, and code quality. Collaborate across engineering teams to prioritize identity and access management improvements, foster ownership, and deliver intuitive user and organizational management experiences. Requirements: Proven experience designing, developing, and evolving enterprise-grade authorization systems operating under real production workloads, with strong judgment regarding architecture, scalability, and security. Hands-on expertise in fine-grained or relationship-based authorization, including schema design for relations, permissions, and caveats, as well as an understanding of the trade-offs compared with traditional role-based access control (RBAC). Experience designing or modernizing authorization systems and migrating from legacy access control approaches. Direct ownership of a migration initiative is a plus. Background working on platform engineering teams that build and maintain foundational services for other teams within a larger engineering organization. Strong backend development experience in Go, Java, or a comparable programming language, with an emphasis on reliable services and maintainable code. Experience running production services on Kubernetes and designing APIs and abstractions intended for adoption by multiple engineering teams. Solid knowledge of identity and authentication protocols, particularly OpenID Connect (OIDC) and Security Assertion Markup Language (SAML). Familiarity with identity providers such as Keycloak, Auth0, Okta, or ForgeRock. Practical experience with cloud workload identity solutions, such as AWS IRSA, Azure Workload Identity, or Google Cloud Workload Identity Federation. Familiarity with secrets and credential management platforms such as HashiCorp Vault. Strong system architecture skills, including the ability to design authorization frameworks that meet enterprise requirements for scale, security, flexibility, and reliability. Demonstrated technical leadership, including influencing architectural direction, leading design discussions, mentoring engineers, and improving team velocity and code quality without relying solely on formal authority. Real-world experience using AI-assisted coding tools while maintaining rigorous security practices, engineering standards, and software quality. Strong communication and problem-solving skills, with the ability to explain complex technical decisions clearly and collaborate across teams. A growth mindset, willingness to challenge existing approaches constructively, and commitment to continuous learning, knowledge sharing, and inclusive teamwork. Preferred: Experience working at an organization that develops identity, authentication, or authorization products. Preferred: A concrete track record of building authorization systems that solve recurring customer challenges and improve enterprise access management. Benefits: Remote work flexibility: Remote opportunity based in Canada, supporting flexibility in how and where you work. Meaningful technical ownership: Shape the architecture of a core identity and authorization platform used to support complex enterprise and AI-driven workloads. High-impact engineering challenges: Work on distributed systems, cloud-native identity, fine-grained access control, and security-sensitive platform infrastructure. Technical leadership opportunities: Influence architectural decisions, establish engineering standards, mentor colleagues, and improve how teams design and deliver software. Continuous learning and development: Contribute to a culture of teaching, knowledge sharing, experimentation, and ongoing professional growth. AI-enabled engineering: Help establish effective development practices that leverage AI tools while maintaining high standards for security and reliability. Collaborative and inclusive culture: Join a team that values diverse perspectives, honest communication, continuous improvement, and the opportunity for every employee to contribute. Compensation and benefits: Specific salary, equity, healthcare, retirement, and paid-time-off details were not provided in the available job description and should be confirmed during the recruitment process.