Principal Platform Engineer | Identity Platform (AuthN/AuthZ)

IFS; Staines-upon-Thames; Hybrid; GBP 120,000 - 160,000; Full time

Benefits offered by this job

Hybrid work opportunities

Job summary

IFS is seeking a Principal Platform Engineer for Identity Platform (AuthN/AuthZ). This hands-on role focuses on building and operating identity infrastructure, not governance.

You will architect a unified authorisation model across multiple hosting environments, implementing scalable, multi-tenant solutions with SpiceDB and Curity/Keycloak in production. You will write Go and shape patterns across engineering teams.

Qualifications

• Fine-grained authorisation systems built and run at production scale
• Hands-on production experience with Zanzibar-style authorisation engines (SpiceDB/OpenFGA/Ory Keto)
• Authorisation schemas and permission models designed for correctness, latency and consistency
• Policy-as-code exposure: OPA/Rego or Cedar
• Running authorisation in production on PostgreSQL with observability

Responsibilities

• Architect and build the authorisation layer across multi-tenant environments
• Own production of the identity platform components
• Write Go code and contribute hands-on engineering
• Operate Curity and Keycloak deployments including upgrades and extensions
• Collaborate with teams to define correct identity patterns

Skills

Fine-grained authorisation

On-call production

Go programming

Production-grade identity systems

Architecture design

Tools

SpiceDB

OpenFGA

Ory Keto

Curity

Keycloak

PostgreSQL

Go

Kubernetes

AKS

OPA/Rego

Cedar

Job description

Principal Platform Engineer || Identity Platform (AuthN/AuthZ)

• Full-time

At IFS, we're building the next generation of AI-native enterprise software, transforming how some of the world's largest organisations manage assets, operations and critical services.

Before you apply

This role is about building and operating identity infrastructure, not administering it or governing it.

It is not a fit if your identity experience is:

• Managing Entra ID, Okta or AWS IAM as a consumer of a platform someone else operates: RBAC, PIM, Conditional Access, SSO configuration, least-privilege policy
• Identity governance and administration: SailPoint, Saviynt, joiner-mover-leaver, access certification campaigns, provisioning workflows
• Security governance, IAM audit, policy authoring or architecture-only work
• Kubernetes RBAC and cloud IAM policies as part of a DevOps or SRE role

All valuable work. None of it is this job.

It is a fit if you have personally run an identity provider in production. Installed it, configured it, extended it, upgraded it, sized it, cut over between versions, restored it, and been on call when authentication broke at three in the morning.

If you have done that with Curity, we want to talk to you today.

This is a hands‑on role and we expect you to still be writing code. We also expect that AI tooling has changed how you work. We'll ask what you delegate, what you still do yourself, and what you built to stop it breaking. Specifics, not a list of tools... so if you can evidence the correct experience for our role, please read on.

IFS is a billion-dollar revenue company with 7000+ employees on all continents. We deliver award-winning enterprise software solutions through the use of embedded digital innovation and a single cloud-based platform to help businesses be their best when it really matters–at the Moment of Service™.

At IFS, we're flexible, we're innovative, and we're focused not only on how we can engage with our customers, but on how we can make a real change and have a worldwide impact. We help solve some of society's greatest challenges, fostering a better future through our agility, collaboration, and trust.

We celebrate diversity and accept that there are so many different perspectives in this world. As a truly international company serving people from around the globe, we realize that our success is tantamount to the respect we have for those different points of view.

By joining our team, you will have the opportunity to be part of a global, diverse environment; you will be joining a winning team with a commitment to sustainability; and a company where we get things done so that you can make a positive impact on the world.

We're looking for innovative and original thinkers to work in an environment where you can #MakeYourMoment so that we can help others make theirs.

If you want to change the status quo, we'll help you make your moment. Join Team Purple. Join IFS.

The job

Authorisation is the single biggest blocker to our next-generation platform right now. Two Principal Platform Engineers are joining to unblock it.

We are consolidating a fragmented authorisation landscape into one model across three hosting environments: our cloud-native platform, our legacy hosting platform and our lifecycle cloud. It is built on SpiceDB (relationship-based access control) on PostgreSQL, and it has to be correct, fast, and multi-tenant at enterprise scale. Alongside it, we run enterprise authentication on Curity, with Keycloak estates migrating onto it.

You will architect and build that, own it in production, and set the identity patterns the rest of engineering follows. This is a hands‑on engineering role. You will write Go.

What we need to see

Authorisation

• Fine-grained authorisation systems you have built and run at production scale, in distributed multi-tenant environments
• Hands‑on production experience with a Zanzibar‑style authorisation engine: SpiceDB, OpenFGA, Ory Keto or equivalent
• Authorisation schemas and permission models you have designed, and the ability to reason about correctness, latency and consistency together
• ReBAC, RBAC and ABAC, and a view on when each is the right answer
• Policy-as-code exposure: OPA/Rego, Cedar or similar
• Running the authorisation engine in production on PostgreSQL, with observability and traceability of the decisions it makes
• Enterprise‑scale authentication you have architected and operated, not integrated with
• Hands‑on production Curity and/or Keycloak: configuration, customisation, extensions, upgrades, operations
• OAuth 2.0, OIDC, SAML 2.0 and token patterns at a level where you can explain why a given flow, what its failure modes are, and where PKCE belongs
• Enterprise federation, SSO and directory integration, in a bring‑your‑own‑identity model with per‑tenant signing keys

Operations and engineering

• Identity infrastructure on Kubernetes (AKS): Helm, persistent volumes, blue/green cutovers, backup and restore, DR
• An IdP under load: config import latency, JVM tuning, pod sizing, dedicated node pools, and a story about what fell over and how you found it
• Go, PostgreSQL, Kafka/RedPanda, GitOps, IaC. Exact match not required, ability to get there fast is
• You still write code. These are principal engineers who build, not IAM consultants who produce documents

How we work

We expect that AI tooling has changed how you work. We will ask what you delegate, what you still do yourself, and what you built to stop it breaking. Specifics, not a list of tools.

We want strong opinions, held out loud. If you would not push back on your director in week two, this will not suit you.

Authorisation (Must Have)

• Architecting and engineering fine‑grained authorisation systems at production scale, in distributed, multi‑tenant environments
• Hands‑on production experience with a relationship‑based / policy‑based authorisation engine, ideally SpiceDB (or comparable Zanzibar‑inspired systems such as OpenFGA, Ory Keto, or equivalent)
• Deep, practical knowledge of authorisation models: relationship‑based access control (ReBAC), role‑based (RBAC), and attribute‑based (ABAC), and knowing when to apply each
• Experience designing authorisation schemas and permission models, and reasoning about correctness, latency, and consistency at scale
• Familiarity with policy‑as‑code approaches and tooling (OPA / Rego, Cedar, or equivalent)
• Understanding of the operational side: running the authorisation engine in production, backed by PostgreSQL, with observability and traceability of authorisation decisions

Authentication (Must Have)

• Architecting and engineering enterprise‑scale AuthN solutions, demonstrated at production scale
• Hands‑on production experience with Curity and/or Keycloak: configuration, customisation, operations, and integration
• Deep, practical knowledge of OAuth 2.0, OpenID Connect (OIDC), SAML 2.0, and token‑based authentication patterns (JWT, opaque tokens, token introspection)
• Experience with enterprise identity federation, SSO, and directory integration (LDAP, Active Directory)
• Strong hands‑on engineering capability across the NGA stack, or the ability to get there fast:
• Backend: Go
• Messaging / Streaming: Apache Kafka / RedPanda
• Data: PostgreSQL
• Comfortable operating in a cloud‑native environment: Kubernetes (AKS), containers, GitOps, Infrastructure as Code
• Event‑driven and distributed systems architecture
• Secure coding practices and security‑by‑design principles

We embrace flexibility and hybrid work opportunities to support diverse needs and lifestyles, while also valuing inclusive workplace experiences. By fostering a sense of community, we drive innovation, strengthen connections, and nurture belonging. Our commitment ensures you can work in a way that suits you best, while also engaging with colleagues to share ideas and build meaningful relationships.