Staff Software Engineer, Identity and Authorization

Team: IT

Location: Canada

Commitment: Full-time

Workplace Type: remote

Accountabilities

• Define and lead the technical architecture for identity and authorization services, building a centralized, fine-grained, relationship-based authorization framework using SpiceDB and reusable permission primitives.

• Evolve enterprise authorization capabilities to support complex user, group, resource, and organizational relationships while replacing fragmented, feature-specific permission checks with consistent platform-wide patterns.

• Strengthen the production readiness of authorization services by addressing scalability, reliability, performance, security, and operational requirements for enterprise and public-sector customers.

• Plan and execute the migration from legacy access control mechanisms to the centralized authorization framework, making sound architectural decisions that minimize disruption and preserve customer trust.

• Design improved group and organizational hierarchy models that reflect complex enterprise structures and support flexible, accurate access management.

• Expand cloud-native identity capabilities by integrating workload identity patterns, starting with AWS IAM Roles for Service Accounts (IRSA) and extending support to Azure and Google Cloud Platform equivalents.

• Establish clean APIs, flexible abstractions, and reusable identity capabilities that enable other engineering teams to integrate authorization into their services effectively.

• Serve as a technical authority for identity and authorization, guiding architectural decisions, clarifying complex trade-offs, and helping engineers resolve challenging design and implementation issues.

• Lead design reviews, improve engineering standards, reduce technical debt, and promote maintainable solutions that increase development velocity while minimizing ongoing operational effort.

• Develop and promote responsible AI-assisted engineering practices that accelerate implementation and testing while preserving security, correctness, and code quality.

• Collaborate across engineering teams to prioritize identity and access management improvements, foster ownership, and deliver intuitive user and organizational management experiences.

Requirements:

• Proven experience designing, developing, and evolving enterprise-grade authorization systems operating under real production workloads, with strong judgment regarding architecture, scalability, and security.

• Hands-on expertise in fine-grained or relationship-based authorization, including schema design for relations, permissions, and caveats, as well as an understanding of the trade-offs compared with traditional role-based access control (RBAC).

• Experience designing or modernizing authorization systems and migrating from legacy access control approaches. Direct ownership of a migration initiative is a plus.

• Background working on platform engineering teams that build and maintain foundational services for other teams within a larger engineering organization.

• Strong backend development experience in Go, Java, or a comparable programming language, with an emphasis on reliable services and maintainable code.

• Experience running production services on Kubernetes and designing APIs and abstractions intended for adoption by multiple engineering teams.

• Solid knowledge of identity and authentication protocols, particularly OpenID Connect (OIDC) and Security Assertion Markup Language (SAML).

• Familiarity with identity providers such as Keycloak, Auth0, Okta, or ForgeRock.

• Practical experience with cloud workload identity solutions, such as AWS IRSA, Azure Workload Identity, or Google Cloud Workload Identity Federation.

• Familiarity with secrets and credential management platforms such as HashiCorp Vault.

• Strong system architecture skills, including the ability to design authorization frameworks that meet enterprise requirements for scale, security, flexibility, and reliability.

• Demonstrated technical leadership, including influencing architectural direction, leading design discussions, mentoring engineers, and improving team velocity and code quality without relying solely on formal authority.

• Real-world experience using AI-assisted coding tools while maintaining rigorous security practices, engineering standards, and software quality.

• Strong communication and problem-solving skills, with the ability to explain complex technical decisions clearly and collaborate across teams.

• A growth mindset, willingness to challenge existing approaches constructively, and commitment to continuous learning, knowledge sharing, and inclusive teamwork.

• Preferred: Experience working at an organization that develops identity, authentication, or authorization products.

• Preferred: A concrete track record of building authorization systems that solve recurring customer challenges and improve enterprise access management.

Benefits:

• Remote work flexibility: Remote opportunity based in Canada, supporting flexibility in how and where you work.

• Meaningful technical ownership: Shape the architecture of a core identity and authorization platform used to support complex enterprise and AI-driven workloads.

• High-impact engineering challenges: Work on distributed systems, cloud-native identity, fine-grained access control, and security-sensitive platform infrastructure.

• Technical leadership opportunities: Influence architectural decisions, establish engineering standards, mentor colleagues, and improve how teams design and deliver software.

• Continuous learning and development: Contribute to a culture of teaching, knowledge sharing, experimentation, and ongoing professional growth.

• AI-enabled engineering: Help establish effective development practices that leverage AI tools while maintaining high standards for security and reliability.

• Collaborative and inclusive culture: Join a team that values diverse perspectives, honest communication, continuous improvement, and the opportunity for every employee to contribute.

• Compensation and benefits: Specific salary, equity, healthcare, retirement, and paid-time-off details were not provided in the available job description and should be confirmed during the recruitment process.