Staff Cybersecurity Software Engineer - Authorization Services

Description

This is a staff-level individual contributor role in the platform security engineering unit, part of the company's security services group.

You will work as a staff software engineer and application-layer security specialist, building and running authorization services that production systems depend on.

You will lead strategic authorization work, raise the bar for authentication and authorization, and shape how users and systems sign in and what they can access. You will guide technical direction, mentor engineers, and work with managers to ship secure, reliable, easy-to-run security products.

The job is execution-heavy and calls for deep expertise. Your influence comes from technical credibility, mentoring, and setting an example.

Responsibilities

• Design and implement authorization frameworks that follow industry standards, then extend them where needed.
• Build access control systems that decide who can take which actions, based on permissions, roles, and attributes.
• Create policy-driven and distributed authorization solutions.
• Lead security and authorization reviews across services and carry fixes through to completion.
• Design, build, test, and maintain cloud-native microservices and APIs, and set direction for how they are built, deployed, and run on public cloud platforms.
• Write clean, testable, secure code in one or more languages such as Go, Java, Python, or JavaScript.
• Write technical guidance, reusable patterns, and guardrails, and help teams adopt them across product environments.
• Build observability for services, including metrics, logs, traces, dashboards, and alerts.
• Model data and manage storage in relational and graph databases.
• Support critical production systems, including taking part in an on-call rotation.

Requirements

• At least 8 years of hands-on application development, including authentication, authorization, or access control.
• A bachelor's degree in computer science, software engineering, information technology, or a related field, or equivalent expertise.
• Deep experience building and maintaining role-based and attribute-based access control for complex use cases.
• Strong programming in one or more of Go, Spring Boot, Python, and JavaScript.
• Experience with infrastructure as code, Helm, GitOps, Argo CD, or similar deployment automation.
• Experience using AI-assisted engineering across design, implementation, testing, debugging, documentation, and ongoing improvement.
• Strong problem-solving with a focus on security, reliability, scalability, and maintainability.
• Clear written and verbal communication, including leading design discussions.
• Experience with Azure, Docker, and Kubernetes (K8s), plus infrastructure automation and comparable DevOps practice.
• Experience building secure applications covering identity, authentication, authorization, role-based access, secrets, and secure service-to-service communication.
• Experience with Azure services such as managed databases, object storage, Key Vault, Redis, and managed identity, or equivalent cloud services.
• Experience with automated testing, CI/CD pipelines, GitHub Actions or similar tools, source control, and production release practice.
• Experience with observability: structured logging, metrics, tracing, health checks, alerting, and operational dashboards.
• Preferred: deep experience with distributed application development, authorization frameworks, and policy engines.
• Preferred: skill in modeling complex permissions and relationships in graph or relationship-focused data stores.
• Preferred: experience building highly available, scalable custom security frameworks and tooling.
• Preferred: hands-on work with IAM, OAuth, OIDC, SpiceDB, or Zanzibar.

Conditions

The base salary range is $160,200 to $246,300. The final offer within that range depends on job-related factors and the selected candidate's location. This figure is a good-faith estimate under applicable state law.

The role is remote. If the selected candidate lives within a set mile radius of a company hub, they must work from that location three times a week, or at another frequency set by their manager.

Relocation support is available for candidates who qualify under company policy.

The company does not provide immigration sponsorship for this role, now or in the future. This covers direct sponsorship, serving as the immigration employer of record, and any work authorization that needs a written submission or other immigration support from the company, such as H-1B, OPT, STEM OPT, CPT, TN, or J-1. Candidates who will need that support should not apply.

Role-related assessments and pre-employment screening may be required before starting.

The company works to be free of unlawful discrimination and to build an inclusive workplace.

Benefits

• Health and wellbeing coverage includes medical, dental, vision, a Health Savings Account, and Flexible Spending Accounts.
• Also included are a retirement savings plan, sickness and accident benefits, and life insurance.
• Paid vacation and holidays, tuition assistance, an employee assistance program, and vehicle discounts, among other offerings.
• Bonus potential: an incentive pay program pays out based on company performance, job level, and individual performance.