Software Engineer, Identity & Access

Menlo Ventures; Stockholms kommun; On-site; SEK 600,000 - 900,000; Full time

Job summary

Menlo Ventures is seeking an Identity and Access Specialist to build and manage the authentication and authorization systems for the Lovable Apps Platform in Stockholm. This full-time role will focus on secure, scalable identity management for platform-level and user-generated applications.

The ideal candidate has deep expertise in identity management concepts, with a strong security mindset and experience operating auth systems at scale. Familiarity with tools like AWS Secrets Manager and experience in multi-tenant contexts are highly valued.

Qualifications

• Deep expertise in identity & access management, including OAuth 2.0, session management, and token lifecycle.
• Experience building or operating auth systems at scale in a multi-tenant SaaS context.
• Strong security mindset focusing on credential safety and tenant isolation.

Responsibilities

• Design and build the identity and access management system for the Apps Platform.
• Implement authentication flows including OAuth 2.0, social login, and MFA.
• Handle secrets infrastructure management for API keys and service tokens.

Skills

OAuth 2.0

Security mindset

RBAC/ABAC models

TypeScript

Tools

Vault

AWS Secrets Manager

Cloudflare

Job description

Location

Stockholm

Employment Type

Full time

Location Type

On-site

Department

Engineering, Platform

TLDR; You will own the identity layer that powers every Lovable app—from auth flows and session management to RBAC, API keys, and multi‑tenancy isolation. This high‑trust, high‑impact role sits at the intersection of security, product, and platform engineering, shaping how millions of end users authenticate into AI‑generated applications.

About Lovable & the Apps Platform

Lovable is an AI‑powered software creation platform that helps users go from idea to working application, generating hundreds of thousands of apps daily. The Apps Platform runs these generated apps in production, provisioning databases, handling user auth, storing files, serving the app over a custom domain, capturing logs, and metering usage. It is the full backend and hosting layer designed so creators never think about infrastructure.

The Role

We need an identity and access specialist to own authentication, authorization, and user management across the Lovable Apps Platform. You will build the identity layer used by both Lovable’s own platform and every user‑generated app, ensuring it is developer‑friendly, security‑hardened, and scalable.

What You’ll Do

• Design and build the Apps Platform’s identity and access management system for both platform‑level and app‑level auth.
• Implement authentication flows: OAuth 2.0/OIDC, magic links, social login, MFA, and session management.
• Build a robust authorization model: RBAC, row‑level security, API key management, and fine‑grained permissions.
• Own multi‑tenancy isolation, ensuring secure separation of user apps, data, and credentials.
• Manage secrets infrastructure: secure storage, rotation, and access control for database credentials, API keys, and service tokens.
• Migrate identity services to a composable layer without breaking user sessions.
• Operate auth as a production service: monitoring, alerting, incident response, and capacity planning.
• Collaborate with AI and product teams to provide secure‑by‑default auth for generated apps.

What We’re Looking For

• Deep expertise in identity & access management: OAuth 2.0, OIDC, SAML, JWT, session management, token lifecycle.
• Experience building or operating auth systems at scale, ideally in a multi‑tenant SaaS/PaaS context.
• Strong security mindset, prioritizing credential leakage, privilege escalation, token theft, and tenant isolation.
• Experience with RBAC/ABAC models and row‑level security in Postgres.
• Familiarity with identity providers and services (Auth0, Supabase Auth, Clerk, Firebase Auth, Keycloak, etc.).
• Comfortable with TypeScript across backend services and API layers.
• History of migrating auth systems or transitioning between identity providers in production without breaking user sessions.
• Operational instincts, focused on uptime, latency percentiles, and blast radius.

Nice to Have

• Experience with secrets management tools (Vault, AWS Secrets Manager, or similar).
• Background in compliance‑relevant auth work (SOC 2, GDPR, HIPAA).
• Familiarity with Supabase Auth internals (GoTrue) or similar open‑source auth servers.
• Experience designing auth for AI‑generated or low‑code applications.
• Knowledge of managed cloud services (AWS, GCP) and trade‑offs of buy‑vs‑build for identity infrastructure.

Our Tech Stack

• Frontend: React and TypeScript.
• Backend: Go and Rust.
• Cloud: Cloudflare, GCP, AWS, Modal.
• Data: Clickhouse, Firestore, Spanner, BigQuery.
• DevOps & Tooling: CI/CD pipelines, OTEL, Kubernetes, Terraform.