Lead Engineer II – Senior Engineer, Authentication and Authorization IRC302231

Description

Requirements

• You should have – 5+ years building auth systems in production SaaS environments.
• – Strong Go or Python (ideally both); comfortable writing performant, well-tested service code in either.
• – Deep knowledge of OAuth 2.0, OIDC, JWT, and SAML — not just using libraries but understanding what’s happening underneath.
• – Experience with authorization policy engines (OPA, Casbin, or equivalent) and modeling complex permission structures.
• – Familiarity with multi-tenant isolation patterns and the security implications of getting them wrong.
• – Comfort in an AWS/EKS environment with secrets management (AWS Secrets Manager, Vault).
• Nice to have: SCIM provisioning, FIDO2/WebAuthn, zero-trust networking, SOC 2 audit experience, or prior work on a shared platform team serving internal consumers.

Job responsibilities

• What you’ll do – Design and operate the centralized authn/authz platform: token issuance and validation (OIDC/JWT), OAuth 2.0 flows, API key management, and service-to-service identity.
• – Build and maintain the authorization model: RBAC and ABAC policies, tenant isolation enforcement, and fine-grained permission evaluation (Open Policy Agent or similar).
• – Expose auth as a shared internal service consumed by the rest of the control plane — clean APIs, well-documented contracts, and minimal coupling.
• – Partner with product and platform teams to implement SSO integrations (SAML, SCIM) and onboard enterprise identity providers.
• – Harden the auth layer: token rotation, secret management, audit logging, and threat modeling against common identity attacks.