Senior Software Engineer, Access & Authorization

Coinbase, Inc.; Des Moines (IA); Hybrid; USD 186,000 - 219,000; Full time

Job summary

Coinbase is seeking a Senior Software Engineer on the Access & Authorization team to design and operate secure, high‑throughput authentication services used across our web, mobile, API, and partner experiences.

You will own end‑to‑end design of OAuth, sessions, tokens, 2FA, and edge authorization, build Go and gRPC services, mentor engineers, and partner with product, security, fraud, and infrastructure teams to balance customer conversion with protection and compliance.

Qualifications

• 5+ years backend software engineering with Go or equivalent.
• Experience designing secure APIs: OAuth, authorization, tokens, and sessions.
• Proficiency with gRPC, Protocol Buffers, and data stores like Redis or DynamoDB.
• Strong observability: metrics, logs, traces, alerts and SLOs.
• Clear communication and cross‑functional collaboration; ability to lead complex projects.

Responsibilities

• Own end‑to‑end design and operation of authentication, OAuth, sessions, tokens, 2FA and edge authorization.
• Build secure, low‑latency Go and gRPC services used across Coinbase platforms.
• Lead technical designs for complex initiatives such as signed tokens, passkeys, biometric recovery and device aware auth.
• Partner with product, security, fraud and infrastructure to balance conversion, protection, regulatory requirements.
• Simplify integration patterns and build self‑service tooling for safe adoption at scale.
• Mentor engineers and raise the technical bar through design reviews and on‑call participation.

Skills

Go

OAuth 2.0

OpenID Connect

JWTs

gRPC

Distributed systems

Security

Tools

Redis

DynamoDB

Protocol Buffers

Job description

Coinbase is seeking a Senior Software Engineer on the Access & Authorization team to design and operate secure, high‑throughput authentication services used across our web, mobile, API, and partner experiences.

You will own end‑to‑end design of OAuth, sessions, tokens, 2FA, and edge authorization, build Go and gRPC services, mentor engineers, and partner with product, security, fraud, and infrastructure teams to balance customer conversion with protection and compliance.