Staff Software Engineer, Identity and Authorization

dominodatalab; United States; Remote; USD 200,000 - 235,000; Full time

Benefits offered by this job

Remote role

Equity option

Bonuses

Health coverage

Wellness benefits

Job summary

Domino Data Lab is seeking a Senior Authorization Architect to set the technical direction for a centralized identity and access platform used by enterprise and public-sector customers. You will shape a reusable, relationship-based permissions model, guide migrations from legacy checks, and help other engineering teams build on the platform with strong security and production readiness.

Responsibilities include designing fine-grained authorization, evolving the architecture for scalability,

Qualifications

• Experience evolving enterprise authorization systems under production traffic.
• Hands-on knowledge of fine-grained or relationship-based authorization and RBAC tradeoffs.
• Strong understanding of OIDC and SAML; familiarity with Keycloak, Auth0, Okta, or ForgeRock.

Responsibilities

• Design fine-grained authorization capabilities and reusable interfaces for consistent permission decisions.
• Guide evolution of the authorization architecture, including migration sequencing and improved group models.
• Improve reliability, security, and scalability for production workloads, including cloud workload identity integrations.
• Lead design reviews, explain architectural decisions, unblock engineers, and establish reusable patterns.
• Reduce technical debt and improve delivery practices, including AI-assisted coding tools.

Skills

Fine-grained authorization

OIDC & SAML

Go/Java backend

Kubernetes

AI coding tools security

Identity providers (Keycloak/Auth0/Ok

Tools

Keycloak

Auth0

Okta

ForgeRock

Job description

Role overview

Set the technical direction for a centralized identity and authorization platform used by enterprise and public-sector customers. You’ll shape a reusable, relationship-based permissions model, strengthen its production readiness, and guide migrations from legacy access checks while helping other engineering teams build on the platform.

Responsibilities

• Design fine-grained authorization capabilities and reusable interfaces that support consistent permission decisions across services.
• Guide the evolution of the authorization architecture, including migration sequencing, legacy access retirement, and improved group and organizational models.
• Improve reliability, security, and scalability for production workloads, including cloud workload identity integrations.
• Lead design reviews, explain architectural decisions, unblock engineers, and establish patterns other teams can adopt.
• Reduce technical debt and improve delivery practices, including responsible use of AI-assisted coding tools.

Requirements

• Experience evolving enterprise authorization systems under production traffic and designing systems that scale for large customers.
• Hands‑on knowledge of fine‑grained or relationship‑based authorization, including schema design and tradeoffs with role‑based access control.
• Strong understanding of OIDC and SAML; familiarity with identity providers such as Keycloak, Auth0, Okta, or ForgeRock is useful.
• Backend engineering expertise in Go, Java, or a comparable language, with experience running services on Kubernetes and designing APIs for platform users.
• Practical experience with cloud workload identity, such as AWS IRSA, Azure Workload Identity, or GCP Workload Identity Federation.
• A record of improving engineering quality and helping teams make sound design decisions; real‑world use of AI coding tools with attention to security and code quality.

Nice to have

• Experience designing a new authorization system and migrating from a legacy approach, working on a platform team, or building identity and access products.
• Familiarity with secrets management systems such as Vault.

Benefits and work setup

• Remote role. The listed annual US base salary range is $200,000–$235,000, with potential additional equity, bonuses, retirement, health coverage, and wellness benefits.