Staff Software Engineer Identity and Access Management (IAM)

We are seeking a Staff Software Engineer to lead the technical design and implementation of a unified Identity and Access Management (IAM) platform that will serve as the foundation for authentication authorization governance and compliance across a
large portfolio of cloud products.
Today identities roles permissions and authentication mechanisms are distributed across multiple products creating operational complexity inconsistent security controls and compliance challenges. The IAM platform will establish a centralized identity governance layer supporting customers partners employees APIs services and autonomous systems.
This is a highly hands-on technical leadership role. You will be expected to personally design build and deliver critical platform components while driving architecture and adoption across multiple engineering organizations. Rather than building every capability
from scratch you will evaluate integrate extend and operationalize leading open-source and commercial technologies to deliver a scalable enterprise-grade platform.

Responsibilities:

Technical Leadership
Define the long-term architecture and technical roadmap for the IAM platform.
Lead identity authentication authorization and access governance initiatives spanning multiple products and engineering teams.
Establish standards reference architectures and best practices for identity and access management across the organization.
Drive platform adoption and migration strategies for existing products and services.

Hands-On Engineering
Design implement and operate core IAM platform services.
Build integrations between identity providers API gateways authorization systems secrets management platforms and SaaS products.
Develop services supporting user lifecycle management machine identity management delegated administration access reviews and compliance reporting.
Implement secure token exchange service-to-service authentication and federated identity workflows.
Build APIs automation and self-service capabilities for onboarding provisioning and access governance.
Troubleshoot and resolve complex scalability reliability and security challenges across the platform.

Security & Governance
Design authorization models supporting RBAC ABAC delegated administration and multi-tenant environments.
Define controls for least privilege separation of duties credential management and privilege escalation prevention.
Ensure complete auditability of access grants modifications reviews and revocations.
Partner with security and compliance teams to meet regulatory and customer requirements.

Platform Engineering
Evaluate and leverage open-source IAM technologies to accelerate delivery while maintaining flexibility and control.
Extend and customize IAM platforms where required to support business-specific use cases.
Define operational requirements for availability disaster recovery observability and security.
Establish engineering practices for platform reliability performance and maintainability.

Required Qualifications
8 years of software engineering experience with significant experience building distributed systems platform services or security infrastructure.
Deep expertise in Identity and Access Management (IAM) authentication authorization federation and access governance.
Strong hands-on experience with OAuth 2.0 OpenID Connect (OIDC) SAML JWTs MFA enterprise SSO and delegated authorization patterns.
Demonstrated experience implementing operating extending or integrating enterprise IAM platforms such as Zitadel Keycloak Authentik ForgeRock Ping Identity Okta Auth0 or equivalent solutions.
Experience building identity platforms by leveraging and extending open-source technologies rather than developing IAM systems entirely from scratch.
Strong understanding of multi-tenant SaaS architectures tenant isolation delegated administration and B2B/B2B2B identity models.
Experience designing and implementing RBAC ABAC policy-based authorization entitlement management and access governance solutions.
Experience building and operating secure API platforms service-to-service authentication and machine identity systems.
Strong software engineering skills with modern backend technologies cloud-native architectures and infrastructure automation.
Experience designing highly available scalable and secure distributed systems.
Proven track record of leading large cross-functional technical initiatives while remaining deeply hands-on in architecture implementation and operational ownership.

Preferred Qualifications
Direct experience implementing or operating Zitadel or similar in a production environment.
Experience integrating IAM platforms with enterprise identity providers including Microsoft Entra ID Okta Google Workspace Ping Identity and Active Directory.
Experience with policy engines and policy-as-code frameworks such as Open Policy Agent (OPA) Cedar or similar technologies.
Experience with machine identity lifecycle management secrets management certificate management and workload identities.
Experience designing audit compliance governance and entitlement review systems.
Familiarity with compliance frameworks such as SOC 2 ISO 27001 HIPAA PCIDSS NIST or FedRAMP.
Experience migrating multiple products or business units to a centralized identity platform.
Experience supporting AI agents autonomous systems or workload identities in enterprise environments