Staff Product Engineer (Agentic Identity & Governance, AI Platform)

Redpanda Data; United States; Remote; USD 170,000 - 230,000; Full time

Benefits offered by this job

Remote first

Comprehensive healthcare

401(k) matching

Unlimited PTO

Home office & education reimbursement

Redpanda swag

Job summary

Redpanda Data is seeking a Staff Software Engineer to own identity, authentication, authorization, and on-behalf-of patterns across the Agentic Data Platform and Cloud platform.

You will design and build systems, extend OAuth 2.1 server and token vault, and collaborate with Okta/Entra/Ping integrations to satisfy enterprise security reviews.

Qualifications

• 10+ years of software development and delivery experience.
• Hands-on expertise in authentication, authorization, or identity systems.
• Experience federating with existing IdPs (Okta, Entra, Ping) in enterprise environments.
• Production experience with OAuth 2.0/2.1, OIDC, token exchange, and delegation.

Responsibilities

• Own the technical direction for AuthN, AuthZ, and OBO across platforms.
• Design and build systems extending OAuth server and token vault.
• Mentor engineers across teams on identity concepts.
• Collaborate with security, product, and platform teams to align with enterprise reviews.

Skills

OAuth 2.1

OIDC

Identity systems

AuthN/AuthZ

Agent delegation

Security in prod

Influence leadership

Tools

GitHub

Job description

• Identity is one of the two gates every enterprise puts in front of agentic AI before it touches production data — alongside observability, it is what turns a compelling demo into something a security team will actually approve
• We already ship a per-data-plane OAuth 2.1 authorization server and token vault, delegated tool access, and support for external agent clients (Claude, ChatGPT, Cursor, Copilot Studio) connecting in through governed paths
• What comes next — how an agent acts on behalf of a human or another agent, how that delegation is proven and audited rather than assumed, and how Redpanda’s identity model federates with (rather than replaces) a customer’s existing IdP — is still being actively defined, inside Redpanda and across the industry
• Standards for agent identity, delegated authorization, and on-behalf-of (OBO) access patterns are moving fast and are genuinely unsettled: this is a domain where the right technical bet made now becomes a durable competitive advantage, and the wrong one becomes years of migration pain
• We’re looking for a Staff Software Engineer to own that direction end to end — AuthN, AuthZ, and OBO for agents — as a charter that spans both Agentic Data Plane and the Cloud platform it runs on
• This is a high-autonomy, high-influence individual contributor role: you will set the technical bet Redpanda makes on an evolving landscape, then roll up your sleeves and build it, not just architect it and hand it off
• Own the technical direction for AuthN, AuthZ, and OBO across Agentic Data Platform and the Cloud platform — deciding which emerging industry patterns Redpanda adopts, adapts, or deliberately avoids
• Design and build the systems yourself: extending the OAuth 2.1 authorization server and token vault, delegated tool-access flows, and the cryptographic delegation model that lets an agent act on-behalf-of a human or another agent with a provable, auditable chain of authority
• Partner closely with the identity-federation surface (Okta, Entra, Ping, and similar) so Redpanda enforces access locally while federating cleanly with what enterprise customers already run
• Work cross-functionally with Agentic Data Plane and Cloud platform engineering, Security, and Product to make sure identity and delegation decisions hold up under real customer security review — not just internal design review
• Represent Redpanda’s technical position on agent identity externally where relevant — in customer-facing security conversations, documentation, or engagement with emerging standards efforts
• Ship to customers: this is an IC role measured on shipped, production-hardened systems, not just architecture proposals
• Mentor and level up engineers across both Agentic Data Platform and Cloud platform on identity and access concepts, without formal management authority over them
• Bring up difficult and/or systemic challenges and impediments to the attention of engineering leadership
• Actively discuss strategic topics with peers and Directors to help shape engineering’s environment
• Track progress, assess risks, and actively communicate contingency and mitigation plans for the initiatives you own

Benefits

• Remote first: We’re a remote-first company that puts humans first. We advocate for working wherever you’re most productive
• Comprehensive healthcare: We’ve got you covered with a mix of plans ranging from fully-paid medical, dental and vision, to premium coverage
• 401(k) matching: Our 401(k) plans let you save for your future. And for our US and UK employees — we match
• Unlimited PTO: Take time to relax and recharge. Option to select region-specific holidays. Our vacation policy puts you in control
• Home office & education reimbursement: $1,000 to gear-up your home office, $50 towards each wifi bill, $500 to invest in your learning and development annually
• Redpanda swag: Hands down the coolest swag in our industry! Your family will steal it. Guaranteed

Eager to thrive with the thrill and ethos of a fast growing startupAble to lead through influence rather than authority — your charter spans both Agentic Data Plane and the Cloud platform team, and on the Cloud platform side you will be driving technical direction with no reporting relationship to lean onExcited to roll up your sleeves and do what it takes to deliver objective results — this role designs, builds, and ships, it does not stop at the design docAccountable, bring a sense of ownership, and are self-drivenA recognized technical authority on identity, access, and delegation systems, comfortable being the person in the room who has to make the call when the industry itself hasn’t converged yet10+ years of experience in software development and delivery, with deep, hands-on expertise in authentication, authorization, or identity systems specificallyExcellent written and verbal communication skills, including the ability to explain identity and delegation tradeoffs to engineers, security teams, and customers who may not share your specialist vocabularyExperience designing systems that must federate with, rather than replace, a customer’s existing identity provider (Okta, Entra, Ping, or similar) in security-conscious enterprise environmentsProduction experience with OAuth 2.0/2.1, OIDC, token exchange or delegation patterns (e.g. RFC 8693, on-behalf-of flows), and the practical tradeoffs of running an authorization server and token vault at scaleA track record of driving technical direction across multiple teams or orgs as an individual contributor — through design docs, RFCs, code, and direct influence, including with teams outside your own reporting chainA strong, current point of view on where agent identity standards are heading — MCP auth, A2A, cross-app access patterns (e.g. Okta XAA, Entra Agent ID, Auth0 for AI Agents) — and the judgment to bet on a direction before the market fully settlesComfortable working with a globally distributed engineering team, collaborating on GitHub, in the open, and a self starterDirect experience building or operating an OAuth 2.1/OIDC authorization server, token vault, or equivalent identity infrastructure in productionExperience with agent-specific identity or delegation protocols (MCP auth, A2A, cross-app access/token exchange patterns) rather than only traditional human-user identity systemsExperience contributing to or closely tracking open standards bodies or working groups relevant to identity, OAuth, or agent authorizationExperience working in regulated or security-sensitive enterprise environments where identity and access decisions faced direct customer security reviewPrior Staff/Principal-level individual contributor experience driving technical direction across multiple engineering organizations