Senior Identity Graph Engineer - Real-Time Trust Layer

Baselayer; San Francisco (CA); Hybrid; USD 230,000 - 340,000; Full time

Benefits offered by this job

Flexible PTO

In-person energy: SF-based, 4 days in/

Competitive compensation with equity

100% health, dental, vision premiums

401(k) with company match

HSA contributions included

Gym stipend $250/month

Transparent, owner-minded culture

Job summary

Baselayer is building the identity layer for institutions across the United States, delivering a scalable, real-time business graph that resolves any entity in milliseconds. You’ll contribute to cryptographic and identity platforms that power trust at scale.

You’ll join a small, hands-on team in San Francisco, working across Python, Go, and edge/offline components to ship foundational infrastructure for financial and enterprise platforms.

Qualifications

• Shipped systems where cryptographic correctness was load-bearing: OAuth/OIDC IdP, token issuer, signing service, or similar.
• Fluent in Python and Go, or strong in one with a track record of learning the other quickly.
• Reads RFCs as primary sources and holds informed opinions on JWK thumbprint canonicalization, pairwise-sub derivation, and Signature-Input header serialization.
• Deep understanding of the distinction between identity and authorization, mandate and claim, snapshot and live state.
• Production experience with async Python on Postgres, including migration safety and observability.

Responsibilities

• Build and maintain the runtime issuer/mint: OAuth Token Exchange, JWS credentials, and Merkle audit log with real-time revocation.
• Own and evolve the wire format and claim registry: JWT profile, verification_level/verification_method enums, and eIDAS/NIST IAL/FATF CDD crosswalk.
• Implement sub-millisecond JWS verification and Web Bot Auth signature checks (RFC 9421) at the HTTP edge for counterparty CDNs, merchants, and publisher paywalls.
• Build and maintain Passport - the user’s cloud-resident principal account with canonical handle, KYC/KYB record, authorized-operators list, audit feed, and authenticator binding.
• Develop operator integration: embedded KYB onboarding inside first OAuth 2.0 consent, per-operator opt-in, and webhook delivery via Svix.
• Work across a Python 3.13 monorepo (FastAPI, Cloud Tasks, Cloud Run, SQLModel/SQLAlchemy) and Go for performance-critical substrate components.

Skills

Python

Go

OAuth/OIDC

RFCs

Async programming

Tools

FastAPI

Cloud Run

SQLAlchemy

PostgreSQL

Svix

WebAuthn

Job description

Baselayer is building the identity layer for institutions across the United States, delivering a scalable, real-time business graph that resolves any entity in milliseconds. You’ll contribute to cryptographic and identity platforms that power trust at scale.

You’ll join a small, hands-on team in San Francisco, working across Python, Go, and edge/offline components to ship foundational infrastructure for financial and enterprise platforms.