Senior Software Engineer - Identity & Authorization Platform

About the role

The Platform Auth team aims to deliver a unified customer identity experience across ClickHouse Cloud. You will help design and build core authentication, authorization, and audit services while collaborating with product engineering teams.

Key responsibilities

• Design and implement platform services for authentication, authorization, token issuance, session handling, and SDKs.
• Model permissions and access‑control primitives that work across ClickHouse, SQL Console, ClickPipes, and HyperDX.
• Implement protocol support for SAML, SCIM, OIDC, OAuth2, and MFA/passwordless flows.
• Build audit and telemetry pipelines to make every access decision observable.
• Partner with product teams to migrate bespoke auth implementations onto the shared platform.
• Participate in on‑call rotation and ensure production reliability for critical systems.

Required profile

• 4+ years building production backend systems at scale.
• Hands‑on experience designing authentication or authorization services (e.g., token issuers, OIDC/OAuth2 providers, policy engines).
• Working knowledge of SAML, SCIM, OIDC, and OAuth2 at the protocol level.
• Experience designing APIs and SDKs that other engineers adopt.
• Experience operating distributed systems with caching, consistency, and multi‑region considerations.
• Familiarity with identity vendors such as Auth0, WorkOS, or cloud IAM services.
• Strong debugging instincts and a focus on developer‑friendly systems.

Required skills

• Go, Rust, C++
• TypeScript, Python
• SAML, SCIM, OIDC, OAuth2, MFA/passwordless
• RBAC, ReBAC, FGA concepts (Zanzibar, OpenFGA, SpiceDB, Cedar)
• Auth0, WorkOS, AWS/GCP/Azure IAM

What we offer

• Flexible remote‑friendly work environment across 25+ countries.
• Employer‑contributed healthcare benefits.
• Equity through stock options.
• Flexible time‑off policies.
• USD 500 home‑office setup allowance for remote employees.
• Global gatherings and off‑site events.