Principal Engineer, Identity and Access Management

Tagetik Software S.r.l.; Greater London; On-site; GBP 90,000 - 130,000; Full time

Job summary

Tagetik Software S.r.l. is seeking a senior security platform architect to lead the design and implementation of a comprehensive authorization framework across web, mobile, APIs and microservices.

You will drive the choice and integration of policy engines, IAM standards and multi-tenant security for scalable SaaS delivery. You will collaborate with platform teams on API and AI gateways, service mesh, and Kubernetes, ensuring robust RBAC, ReBAC, ABAC and ACL models with OAuth2/OpenID

Qualifications

• 10+ years engineering in security/platform.
• 5+ years security platform experience.
• Experience building authorization engines using RBAC, ReBAC, ABAC, ACL.
• Experience designing authorization for multi-tenant SaaS, microservices, APIs.
• Experience with OAuth2, OpenID Connect, JWT, SAML.
• Strong distributed systems experience.

Responsibilities

• Lead architecture and implementation of web applications, mobile, APIs, microservices, AI gateway, agent runtime, MCP tools, Knowledge Graph, and vector stores.
• Design authorization decision architecture: PEP, PDP, Policy Store, and Relationship Store.
• Lead adoption of OpenFGA/SpiceDB, Cedar, OPA, Zanzibar concepts.
• Work with platform teams on API Gateway, AI Gateway, Kubernetes, and service mesh.
• Ensure secure, scalable, multi-tenant distributed systems using OAuth2/OpenID Connect/JWT/SAML.

Skills

10+ years engineering

Security platform experience

RBAC

ReBAC

ABAC

ACL

OAuth2

OpenID Connect

JWT

SAML

Multi-tenant SaaS

Tools

OpenFGA

SpiceDB

OPA

Cedar

Envoy

Istio

Kubernetes

SPIFFE/SPIRE

Job description

• Lead architecture and implementation of,
• Web applications
• Mobile
• APIs
• Microservices
• AI Gateway
• Agent runtime
• MCP tools
• Knowledge Graph
• Vector stores
• Design authorization decision architecture:
• PEP
• PDP
• Policy Store
• Relationship Store
• Decision
• Lead adoption of:
• OpenFGA / SpiceDB
• Cedar
• Open Policy Agent (OPA)
• Zanzibar concepts
• Work with platform teams on:
• API Gateway
• AI Gateway
• Kubernetes
• Service Mesh
• mTLS,
• Google Zanzibar
• OpenFGA
• SpiceDB
• OPA
• Cedar
• Envoy
• Istio
• SPIFFE/SPIRE
• 10+ years engineering
• 5+ years security platform experience
• Demonstrable experience building authorization engines using:
• RBAC
• ReBAC
• ABAC
• ACL
• Experience designing authorization for:
• Multi-tenant SaaS
• Microservices
• APIs
• Experience with:
• OAuth2
• OpenID Connect
• JWT
• SAML
• Strong distributed systems experience
• Applicants may be required to appear onsite at a Wolters Kluwer office as part of the recruitment process.

Our Interview Practices To maintain a fair and genuine hiring process, we kindly ask that all candidates participate in interviews without the assistance of AI tools or external prompts. Our interview process is designed to assess your individual skills, experiences, and communication style. We value authenticity and want to ensure we're getting to know you-not a digital assistant. To help maintain this integrity, we ask to remove virtual backgrounds and include in-person interviews in our hiring process. Please note that use of AI-generated responses or third-party support during interviews will be grounds for disqualification from the recruitment process.