Principal Software Engineer

Siteimprove; Bellevue (WA); In loco; USD 140.000 - 210.000; Tempo pieno

Descrizione del lavoro

Siteimprove is seeking a Software Engineer with deep authentication, authorization, and IdP expertise to secure our platform and serve enterprise clients. You will design login, MFA, token services, and SSO integrations, while shaping policy-driven authorization for product teams and AI agents.

You will own provisioning workflows, drive reliability and observability, and mentor engineers. The role requires strong cloud experience on AWS or Azure and a clear, collaborative communication style.

Competenze

• 6+ years of professional software engineering, with 3+ years in authentication/identity systems in production.
• Strong backend skills in C#/.NET or Java depending on service.
• Deep knowledge of OAuth 2.0/2.1, OpenID Connect, and SAML 2.0.

Mansioni

• Build and run login, session, MFA, and token services (SSO/federation).
• Own SAML and OIDC integrations with customer IdPs.
• Define and improve provisioning across SCIM, JIT, and deprovisioning.
• Evolve centralized permissions and authorization services at scale.
• Define how AI agents and MCP servers authenticate via OAuth 2.x and token exchange.
• Design against token abuse and ensure FedRAMP identity controls.
• Lead design reviews and mentor engineers across the team.
• Travel may be required; a valid passport is required.

Conoscenze

Engineering depth

Backend stack

OAuth 2.0 / OIDC / SAML

IdP experience

Authorization design

Security mindset

Cloud-native systems (AWS/Azure)

AI-native delivery

Clear communication

Descrizione del lavoro

Siteimprove is the leader in agentic content intelligence. Our platform brings accessibility, analytics, SEO/AEO, and content strategy together in one system, where AI agents work alongside marketing and digital teams to produce content that is accessible and easy to find. Every customer, user, and increasingly every AI agent that touches the Siteimprove platform goes through systems owned by the Access team: sign-in, single sign-on, federation with customer identity providers, and the authorization layer that decides who can see and do what. We're looking for a Software Engineer with real depth in authentication, authorization, and identity provider (IdP) systems. You'll design and build the services that secure the Siteimprove platform, work with enterprise and public-sector customers' SSO setups, help us meet FedRAMP requirements, and shape how AI agents and machine clients authenticate against our APIs and MCP servers. This is a hands-on role with a lot of technical ownership. You'll be one of the people others on the team, and across engineering, come to with identity questions.

What we will be doing

• SSO and federation: Build and run our login, session, MFA, and token services. Own SAML and OIDC integrations with customer IdPs (Okta, Entra ID, Ping, ADFS), from metadata and certificate rotation to enterprise edge cases.
• Provisioning: Own the user lifecycle across SCIM, JIT provisioning, and deprovisioning.
• Authorization platform: Evolve our centralized permissions and authorization services, including the models (RBAC, ABAC, ReBAC), APIs, and caching, so product teams get fast, consistent access decisions.
• Agent identity: Define how AI agents, MCP servers, and integrations authenticate and get delegated, least-privilege access through OAuth 2.x (token exchange, scoped short-lived tokens), with consent and auditability built in.
• Security and compliance: Design against account takeover and token abuse. Implement FedRAMP identity controls (FAL2, signed and encrypted assertions, FIPS-validated cryptography), and work with Security and GRC on audit evidence and addressing vulnerabilities.
• Reliability: Raise the bar for reliability and observability on services where an outage means nobody can log in.
• Technical leadership: Lead design reviews and build-vs-buy decisions, mentor engineers, and be the go-to identity expert across engineering.
• Travel may be required; a valid passport is required
• Perform other duties as assigned

What we will require of you

• Engineering depth: 6+ years of professional software engineering, with at least 3 years building or running authentication, authorization, or identity systems in production.
• Backend stack: Strong backend skills in C#/.NET or Java, and a willingness to work in whichever one a given service uses.
• Protocol expertise: Deep, practical knowledge of OAuth 2.0/2.1, OpenID Connect, and SAML 2.0: grant types, token formats JWT, PKCE, token lifetimes and revocation, and assertion signing and encryption.
• IdP experience: Hands-on experience with at least one IdP, whether in-house, open source (such as Keycloak), or commercial (such as FusionAuth, Auth0, Okta, Entra ID, or Cognito), including integrating customer IdPs for enterprise SSO.
• Authorization design: Experience designing authorization models and permission services that stay correct and fast at scale.
• Security mindset: A solid grasp of identity threats (token theft and replay, session fixation, CSRF, open redirects, IdP-initiated SSO risks) and how to design against them.
• Cloud-native systems: Experience building distributed services on AWS or Azure, including containers, CI/CD, and production observability.
• AI-native delivery: You use AI tools every day to understand code, generate tests, and ship faster.
• Clear communication: You can explain a tricky identity trade-off to engineers, product managers, and auditors.

What we will love about you

• Experience with FedRAMP, or other government compliance programs, and with NIST SP 800-63 identity and federation assurance levels.
• Experience with FIPS 140-validated crypto modules, HSM or KMS-backed key management, and certificate lifecycle automation.
• Experience with policy engines or fine-grained authorization systems such as OPA, Cedar, OpenFGA, or other Zanzibar-style systems.
• Familiarity with the Model Context Protocol (MCP) authorization spec, OAuth token exchange, or workload identity (CIMD, IAM roles for service accounts).
• Experience with SCIM 2.0.
• Experience leading a migration between identity platforms without disrupting customers.

What you'll love about us

We re building the next generation of AI-powered content intelligence, helping organizations unify accessibility, SEO/AEO, analytics, and content performance into one platform. If you re energized by solving complex problems, working cross-functionally, and contributing to a product with real-world impact, we d love to connect.

In addition, we hope you will appreciate:

At Siteimprove, we're committed to supporting your wellbeing both at work and beyond. Our Denmark benefits are designed to help you thrive personally and professionally.

Rest and relaxation: Generous time off including Danish holiday entitlements, five additional FF Days, child sick leave, and bereavement leave.
Comprehensive benefits: Health insurance, company-paid mobile phone support, and internet allowance to support your day-to-day needs.
Prepare for the future: Danica pension with employer contributions to help support your retirement goals.

The base salary for this role will fall within the posted range and is determined by experience, qualifications, and location.

Siteimprove is an equal opportunity employer

All qualified applicants will receive consideration for employment without regard to race, color, sex, sexual orientation, gender identity, religion, national origin, disability, veteran status, age, marital status, pregnancy, genetic information, or other legally protected status.

Siteimprove is a global corporation that has developed data practices to ensure your personally identifiable information is appropriately protected. Please note that personal information may be transferred, accessed, and stored globally as necessary for the uses and disclosures stated in accordance with our Privacy Policy at https://siteimprove.com/en/privacy/ .

FedRAMP Authorization Notice for Job Postings

This position may involve access to systems, information, or customer environments that are subject to the Federal Risk and Authorization Management Program (FedRAMP). Where applicable, FedRAMP-related responsibilities will be outlined in the job description.

If the role includes FedRAMP-related duties, candidates may be required to meet the following requirements:

Identity Verification: Candidates must successfully complete federal I-9 employment eligibility verification.

Citizenship/Residency Requirement: Certain roles may be limited to U.S. citizens or lawful permanent residents if job duties include access to controlled systems, environments, or data.

Access Authorization: Employment offers for applicable roles are contingent upon confirmation that the candidate meets the minimum access requirements associated with the FedRAMP authorization level required for the position.

By applying, you acknowledge that, if the role includes FedRAMP-related responsibilities, employment may be subject to these authorization and verification requirements.