Senior Identity & Authorization Platform Engineer (Remote)

ClickHouse; Poland; Remote; PLN 180,000 - 260,000; Full time

Benefits offered by this job

Flexible work environment

Healthcare

Equity in the company

Time off

A USD$500 Home office setup

Global Gatherings

Job summary

ClickHouse is seeking engineers to join the Platform Auth team to unify access management and standardize authentication patterns across the platform. You will design and build services for authentication, authorization, and audit, and implement protocol support for SAML, SCIM, OIDC, OAuth2, and MFA flows.

You will also model permissions across multiple products and own the telemetry surface for every access decision.

Qualifications

• 4+ years building production backend systems at scale.
• Experience designing/authenticating services like token issuers or OIDC providers.
• Knowledge of SAML, SCIM, OIDC, OAuth2 at protocol level.
• Ability to design APIs and SDKs used by other engineers.
• Experience operating distributed systems, caching and multi-region concerns.
• Familiarity with identity vendors (Auth0, AWS/GCP/Azure IAM).
• Strong production debugging instincts and robust, developer-friendly systems.

Responsibilities

• Design and build platform services for authentication, authorization, and audit.
• Model permissions and access control primitives across multiple products.
• Implement protocol support for SAML, SCIM, OIDC, OAuth2, and MFA flows.
• Build audit/telemetry pipelines to surface access decisions.
• Collaborate with product teams to migrate bespoke auth to a shared platform.
• Maintain production reliability and participate in on-call rotations.

Skills

Go

Rust

C++

TypeScript

Python

Auth0

WorkOS

AWS/GCP/Azure IAM

Tools

OpenFGA

SpiceDB

Cedar

OIDC

SAML

SCIM

Job description

ClickHouse is seeking engineers to join the Platform Auth team to unify access management and standardize authentication patterns across the platform. You will design and build services for authentication, authorization, and audit, and implement protocol support for SAML, SCIM, OIDC, OAuth2, and MFA flows.

You will also model permissions across multiple products and own the telemetry surface for every access decision.