Senior Software Engineer, Identity & Authorization

Jobtailor; Foster City (CA); Hybrid; USD 180,000 - 240,000; Full time

Job summary

Replit is seeking a Senior Backend Security Engineer to design, build, and operate identity and authorization systems protecting critical interactions across multi-tenant environments. You will lead the evolution of enterprise access controls, roles, and workspace policies using modern protocols like OAuth 2.0, JWT, and mTLS.

You will own the security health of shipped systems, collaborate with multiple teams, and drive secure migrations with shadow evaluation and telemetry.

Qualifications

• Experience shipping and operating security-sensitive backend systems in production, with focus on reliability, performance, incidents, and observability.
• Strong background in authentication, authorization, or identity systems (OAuth 2.0/OIDC, JWT, mTLS, Federation, RBAC, Zanzibar, policy engines).
• Deep understanding of multi-tenant security, least privilege, delegation, auditability, and threat modeling.
• Experience migrating security-sensitive systems without breaking callers (typed contracts, shadow evaluation, staged enforcement).
• Fluent in at least one production backend stack.

Responsibilities

• Design, build, and operate identity and authorization systems protecting critical interactions.
• Operate central authorization interfaces with typed principals, actions, resources, decisions, and explainable deny reasons.
• Evolve enterprise roles, groups, app access, entitlements, and workspace policies.
• Build and operate a Security Token Service and workload identity using OAuth 2.0, JWT/OIDC, SPIFFE/SPIRE, and mTLS.
• Lead migrations with shadow evaluation, feature gates, telemetry, and rollback plans.

Skills

OAuth 2.0

JWT

MTLS

Multi-Tenant Security

TypeScript

Tools

Go

Rust

Postgres

GRPC/Protobuf

Kubernetes

Envoy

Restate

Job description

• Design, build, and operate identity and authorization systems protecting critical Replit interactions
• Design and operate central authorization interfaces with typed principals, actions, resources, decisions, explainable deny reasons, privilege attenuation, delegations, and obligations
• Evolve enterprise roles, groups, app access, entitlements, and workspace policies
• Build and operate Replit's Security Token Service and workload identity using OAuth 2.0 token exchange, JWT/OIDC, SPIFFE/SPIRE, and mTLS
• Threat-model delegation, confused-deputy risks, and cross-tenant movement, establishing secure fail-closed defaults
• Lead compatible migrations with shadow evaluation, feature gates, telemetry, and rollback plans
• Own SLOs, incidents, and operational health of shipped systems
• Partner with Agent, Connectors, Enterprise, Security, and Infrastructure teams to turn product requirements into shared platform primitives
• Research and develop innovative approaches to Authx in the agentic world
• Evolve central policy decision points, agent delegation, enterprise access control, and service identity and reliability systems

Requirements

• Experience shipping and operating security-sensitive backend or distributed systems in production, including reliability, performance, incidents, and observability
• Depth in authentication, authorization, or identity systems, such as OAuth 2.0/OIDC, JWT, mTLS, Identity Federation, RBAC, ReBAC, PBAC, Zanzibar, Macaroons, Biscuits, Cedar, or policy engines
• Strong understanding of multi-tenant security, least privilege, delegation, privilege attenuation, auditability, and threat modeling
• Experience migrating security-sensitive systems without breaking callers, using approaches such as typed contracts, shadow evaluation, and staged enforcement
• Fluent in at least one production backend stack
• Ability to make and communicate tradeoffs across security, reliability, latency, product experience, delivery speed, and long-term maintainability
• Familiarity with TypeScript, Go, Rust, Postgres, gRPC/Protobuf, Kubernetes, Envoy, and Restate
• Ability to work from the Foster City, CA headquarters 3 days per week, or willingness to relocate near the office
• Legally authorized to work in the United States
• Must be at least 18 years of age

Core Competencies

Demonstrates expertise in designing and operating identity and authorization systems, with a strong focus on security-sensitive backend systems and multi-tenant security. Proficient in implementing OAuth 2.0, JWT, and mTLS, while effectively communicating tradeoffs across security and performance metrics.

Highest-signal resume keywords

• OAuth 2.0
• JWT
• MTLS
• Multi-Tenant Security
• TypeScript

Hard Skills

• Authentication Systems
• Authorization Systems
• Identity Federation
• RBAC
• ReBAC
• PBAC
• Zanzibar
• Shadow Evaluation
• Typed Contracts
• Production Backend Stack

Soft Skills

• Communication
• Problem-Solving

Industry Keywords

• Security Token Service
• Privilege Attenuation
• Threat Modeling
• Auditability
• Operational Health

Tools & Technologies

• Go
• Rust
• Postgres
• GRPC/Protobuf
• Kubernetes
• Envoy
• Restate