Principal Platform Engineer - IAM & AuthN/AuthZ

IFS; Staines-upon-Thames; Hybrid; GBP 120,000 - 180,000; Full time

Job summary

IFS is building the next generation of AI-native enterprise software, and seeks a Principal Platform Engineer for Identity & Access Management. You will be the technical authority on authorisation and authentication across Kairos and Nexus platforms, architecting and operating enterprise-scale IAM patterns that enable developers and end-users while maintaining security.

This hands-on role combines architectural scope with delivery, unifying authorisation across multi-tenant environments and

Qualifications

• Architecting and engineering fine-grained authorisation systems at production scale.
• Hands-on production experience with a relationship-based / policy-based authorisation engine, preferably SpiceDB.
• Deep knowledge of ReBAC, RBAC and ABAC, with guidance on when to apply each.
• Experience designing authorisation schemas and permission models for correctness and performance.
• Familiarity with policy-as-code approaches and tooling (OPA / Rego, Cedar, or equivalent).
• Operational experience running authorisation engines in production with observability.

Responsibilities

• Architect and engineer the unified, enterprise-scale authorisation platform across Nexus, F1, and LEC.
• Design fine-grained authorisation models: ReBAC, RBAC, ABAC.
• Model authorisation schemas, relationships, and permission checks at scale.
• Own operation of SpiceDB on PostgreSQL with CNPG migration and blue-green deployment.
• Build authorisation APIs and SDKs consumed by product teams.
• Architect and engineer enterprise-scale AuthN solutions using Curity and/or Keycloak.
• Implement OAuth 2.0, OIDC, and SAML patterns at scale with token lifecycle management.
• Define IAM patterns and golden paths for secure, consistent product team usage.
• Integrate IAM with the Internal Developer Platform for self-service authentication and authorisation.
• Provide SME guidance on identity and access security to stakeholders.
• Maintain reliability, performance, and security posture of IAM services.
• Contribute to broader platform engineering roadmap with an IAM-first perspective.

Skills

SpiceDB

RBAC

ABAC

OAuth 2.0

OIDC

SAML

Kubernetes

Go

PostgreSQL

Security-by-design

Tools

Curity

Keycloak

OPA

Rego

OpenFGA

Ory Keto

LDAP

Job description

IFS is building the next generation of AI-native enterprise software, and seeks a Principal Platform Engineer for Identity & Access Management. You will be the technical authority on authorisation and authentication across Kairos and Nexus platforms, architecting and operating enterprise-scale IAM patterns that enable developers and end-users while maintaining security.

This hands-on role combines architectural scope with delivery, unifying authorisation across multi-tenant environments and