Staff Software Engineer, Security Platform: Authentication

Accountabilities: • Define and drive the technical direction of authentication protocols, including OAuth 2.0, OpenID Connect (OIDC), SAML, and token exchange, across existing applications and modern authentication services.

• Lead the design and implementation of scalable authentication and identity solutions supporting millions of users across cloud-hosted, self-managed, and dedicated environments.

• Develop architectural strategies, technical design documents, and Architecture Decision Records (ADRs) for complex, multi-quarter engineering initiatives.

• Break down large technical projects into manageable development milestones and deliver improvements through incremental, feature-flagged releases.

• Lead critical authentication migrations, ensuring backward compatibility and uninterrupted customer experiences when transitioning token formats, client configurations, authorization grants, and session management.

• Take a hands-on approach to complex engineering challenges, contributing code in Ruby on Rails and Go while reviewing technical designs and code contributions from other engineers.

• Collaborate with teams responsible for authentication infrastructure, authorization, platform architecture, and multi-tenant scalability to establish and maintain clear technical interfaces and integration contracts.

• Strengthen platform security by conducting threat modeling, implementing rate limits and abuse-prevention mechanisms, and addressing potential vulnerabilities involving token theft, replay attacks, revocation, and access control.

• Lead technical responses to authentication-related incidents, ensuring system reliability, availability, and operational resilience.

• Mentor senior and intermediate engineers, share expertise in authentication protocols and security best practices, and promote high engineering standards across the organization.

• Collaborate asynchronously with globally distributed teams across India, Europe, and the Americas, documenting decisions and maintaining effective written communication.

• Participate in on-call rotations and operational support activities in accordance with team responsibilities.

Requirements:

• Significant experience designing, developing, and operating production-grade authentication or identity management systems at scale.

• Demonstrated technical leadership, including the ability to guide cross-functional teams, resolve complex architectural challenges, establish technical direction, and translate strategic decisions into production-ready solutions.

• Deep practical knowledge of OAuth 2.0 and OpenID Connect (OIDC), including Authorization Code Flow with PKCE, refresh token rotation, token exchange, client registration, scopes, JSON Web Tokens (JWTs), signing keys, and key rotation.

• Working knowledge of SAML 2.0 single sign-on and enterprise identity integrations, such as LDAP, System for Cross-domain Identity Management (SCIM), or equivalent technologies.

• Strong production experience with Ruby on Rails or Go, together with the willingness and ability to work across both technology stacks.

• Experience modernizing large, established codebases through careful refactoring, feature-flagged deployments, and backward-compatible migrations.

• Strong security-oriented engineering mindset, with an understanding of authentication threats, token lifecycle management, credential protection, access control, and risk mitigation.

• Experience developing multi-tenant Software-as-a-Service (SaaS) platforms, including tenant data isolation, scalability, and performance optimization under high request volumes.

• Excellent written communication skills in English and the ability to collaborate effectively in a fully remote, asynchronous working environment.

• Strong problem-solving, architectural design, decision-making, and stakeholder management capabilities.

• Ability to mentor engineers, provide constructive technical feedback, and influence engineering practices across teams.

• Additional experience with authentication libraries such as Doorkeeper, Devise, or OmniAuth; passkeys; multi-factor authentication; workload identity; gateways; policy engines; AI agent authentication; or multi-region architectures is highly valued.

• Contributions to open-source identity projects or involvement in identity and authentication standards development are considered an advantage.

• Candidates are encouraged to apply even if they do not meet every listed qualification, as relevant experience and demonstrated potential are also valued.

Benefits:

• Fully remote working environment, with location-based eligibility requirements depending on the role.

• Flexible Paid Time Off (PTO) to support work-life balance and personal well-being.

• Equity compensation and access to an Employee Stock Purchase Plan.

• Growth and Development Fund to support continuous learning and professional advancement.

• Parental leave benefits.

• Team Member Resource Groups that encourage inclusion, connection, and community.

• Health, financial, and well-being support programs.

• Opportunities to work on large-scale security infrastructure and cutting-edge technologies.

• Exposure to international engineering teams and opportunities for professional growth through collaboration and knowledge sharing.

• An inclusive workplace that values diverse perspectives, equal opportunities, and individual contributions.

How Jobgether works: We use an AI-powered matching process to ensure your application is reviewed quickly, objectively, and fairly against the role's core requirements. Our system identifies the top-fitting candidates, and this shortlist is then shared directly with the hiring company. The final decision and next steps (interviews, assessments) are managed by their internal team. We appreciate your interest and wish you the best! Why Apply Through Jobgether?

Data Privacy Notice: By submitting your application, you acknowledge that Jobgether will process your personal data to evaluate your candidacy and share relevant information with the hiring employer. This processing is based on legitimate interest and pre-contractual measures under applicable data protection laws (including GDPR). You may exercise your rights (access, rectification, erasure, objection) at any time.

#LI-CL1