Identity Consent and Delegation Engineer

HushOne, Inc.; Kirkland (WA); On-site; USD 150,000 - 230,000; Full time

Benefits offered by this job

Stock options

Gym membership

Health insurance

Dental & Vision

Life insurance

Disability coverage

401(k) match

AI tokens

Referral bonus

Job summary

HushOne, Inc. seeks an experienced identity/authorization engineer to design and implement secure, scalable flows for enrollment, authentication, and consent across devices and workers. The role emphasizes strong distributed-systems reasoning and clear separation between identity and permissions.

You will work in a fast-paced, security-focused environment building auditable grant flows and ensuring revocation works promptly across multiple machines and environments.

Qualifications

• Experience in identity or authorization engineering with distributed-systems reasoning.
• Maintain separation between identity, authentication, permission and consent.
• Design to support prompt revocation across machines and delegation chains.

Responsibilities

• Design and implement device enrollment, authentication, and consent records with scoped delegation.
• Ensure the system enforces the separation between identity, authentication, permission and consent.
• Build and verify grant-use-revoke flows with durable evidence across devices and workers.

Skills

Identity engineering

Authorization engineering

Distributed systems reasoning

Delegation and revocation design

Job description

The work:

Build device enrollment, authentication, consent records and scoped delegation. Use established identity protocols with purpose, audience, expiry and resource constraints. Keep household members separate, support explicit sharing and test revocation across devices, connectors and workers.

What good looks like:

In your first 90 days, demonstrate a complete grant-use-revoke flow with durable evidence and clear behavior for offline devices.

Evidence we look for:

Bring identity or authorization engineering experience and strong distributed-systems reasoning. Understand the separation between identity, authentication, permission and consent.

Required:

• Identity or authorisation engineering with strong distributed-systems reasoning
• You hold the separation between identity, authentication, permission and consent clearly, and design to it
• You make revocation work promptly and verifiably, including across machines
• You reason about delegation chains and where authority stops

Nice to have:

• Capability-based security or macaroons
• OAuth, OIDC, or verifiable credentials at depth
• You have implemented a consent or permission model somebody audited

The exercise:

Design a temporary accountant delegation that permits selected records but cannot expand into the user's complete vault.

How we work:

We work together in the office, five days a week, and you can be based at any of our garages: Kirkland Garage (Kirkland, WA); UAE Garage (Dubai, Dubai). We hire across the United States, India and the UAE. We are remote-friendly around family: if you need to work from home some days to look after the people you love, we arrange that with you one person at a time, and we encourage people to use it rather than tough it out.

Pay:

We publish what we pay. Indicative ranges by market and level are on our compensation page, and they are realistic going market rates rather than headline numbers. Wherever we hire we pay at least the local market rate, and for full-time roles our floor is a living wage, never the statutory minimum. Compensation is reviewed every year and on promotion.

Equity:

Every full-time teammate gets stock options. Four-year vesting with a one-year cliff, sized to role, level and impact, and confirmed in writing at offer. High performers earn refresh grants.

Bonus and commission:

An annual performance bonus tied to clear company and personal goals, indicatively 10 to 20 percent of base for non-sales roles. Customer-facing roles carry on-target earnings, typically a 50/50 split of base and variable, with uncapped commission and accelerators above quota.

Health and peace of mind:

Medical, dental and vision for you and your family, plus life and disability cover. We have chosen the highest plan tier available to us rather than the cheapest one that clears the bar, because the point of this is that you never have to think about it. The specific plan numbers are confirmed in your offer letter.

401(k) with company matching:

A 401(k) with a company match, so the years you spend here compound into something that is yours whatever happens next. The match formula is confirmed in your offer letter.

AI tokens:

A budget of AI tokens of your own, because a company that says you should own your AI cannot be the company that rations it. Use them on the work and on whatever you are curious about.

Gym, and the everyday things:

A gym membership, and a corporate benefits programme with its own app, where you redeem real discounts with a long list of retailers on the ordinary purchases of a life.

Family:

We are remote-friendly around your family, arranged one person at a time, and we would rather you took it than toughed it out.

Referrals:

Refer someone we hire full-time who stays a year and you get $1,000 plus $10,000 in referral stock-based equity, on top of your own package.