Staff Backend Engineer — Access & Authorization

Coinbase, Inc.; Augusta (ME); On-site; USD 218,000 - 257,000; Full time

Benefits offered by this job

Equity

Bonus eligibility

Health benefits

Job summary

Coinbase, Inc. is seeking a Staff Software Engineer for the Access & Authorization team. You will design and operate authentication, OAuth, sessions, tokens, 2FA, and edge authorization across Coinbase products with scalable, secure architectures.

You’ll build low-latency Go/gRPC services, drive designs for signed tokens, passkeys, biometric recovery, and device-aware authentication, while partnering with product, security, and infra teams to balance user experience and regulatory needs.

Qualifications

• 8+ years of backend software engineering with production-grade systems.
• Experience designing secure APIs, authentication, authorization, and token handling.
• Proficiency with Go or similar systems language and distributed services.

Responsibilities

• Own end-to-end design and operation of authentication, sessions, tokens, and 2FA.
• Build secure, low-latency Go and gRPC services used across Coinbase products.
• Lead technical designs for passkeys, device-aware auth, and mobile OAuth.
• Collaborate with product, security, fraud, and infra teams for balance of risk and UX.
• Create self-service tooling to scale access capabilities safely.
• Mentor engineers through design reviews, pairing, and on-call work.

Skills

Backend software engineering

Go

Distributed services

OAuth 2.0/OpenID Connect

JWTs/PKCE

gRPC/Protobuf

Redis/DynamoDB

Security-focused design

SLOs/Observability

Tools

Go

gRPC

Protocol Buffers

Redis

DynamoDB

Job description

Coinbase, Inc. is seeking a Staff Software Engineer for the Access & Authorization team. You will design and operate authentication, OAuth, sessions, tokens, 2FA, and edge authorization across Coinbase products with scalable, secure architectures.

You’ll build low-latency Go/gRPC services, drive designs for signed tokens, passkeys, biometric recovery, and device-aware authentication, while partnering with product, security, and infra teams to balance user experience and regulatory needs.