Senior IAM Systems Engineer: Global-Scale, AI-Driven

CloudFlare; Austin (TX); Hybrid; USD 150,000 - 190,000; Full time

Benefits offered by this job

Hybrid work model

Health benefits

Professional growth

Job summary

Cloudflare is seeking a hands-on Senior Systems Engineer for Identity & Access Management to own authentication and authorization surfaces at global scale. You will design high-throughput IAM features, build secure APIs, and ensure resilience under production load.

You will collaborate with Product, Security and UX teams, apply CI/CD practices, and leverage AI-assisted development tools. The role is hybrid in Austin, TX, with opportunities to work across a world-class network.

Qualifications

• 5–8 years building and operating production systems at scale.
• Hands-on experience implementing identity protocols or fine-grained authorization systems (RBAC/ABAC, Cedar, etc.).
• Proficiency with OAuth 2.0, OIDC, SAML, SCIM, and session management.
• Experience designing and building REST APIs with robust authentication and authorization.

Responsibilities

• Feature development: design and build high-throughput IAM capabilities for APIs.
• System evolution: evolve authentication/authorization architectures for distributed and edge-capable deployments.
• API and system design: translate requirements into robust APIs and specifications with cross-team collaboration.

Skills

Identity protocols

Go/Typescript

REST API design

Distributed systems

RBAC/ABAC

OAuth/OIDC/SAML

Tools

Docker

Kubernetes

Terraform

Prometheus

Redis

Job description

Cloudflare is seeking a hands-on Senior Systems Engineer for Identity & Access Management to own authentication and authorization surfaces at global scale. You will design high-throughput IAM features, build secure APIs, and ensure resilience under production load.

You will collaborate with Product, Security and UX teams, apply CI/CD practices, and leverage AI-assisted development tools. The role is hybrid in Austin, TX, with opportunities to work across a world-class network.