Software Engineer - IAM

Software Engineer – IAM

Responsibilities

- Design, build, and harden identity and access flows — OIDC/OAuth 2.0, SAML 2.0, Active Directory integrations — that sit in front of mission-critical systems.

- Own token and assertion lifecycle correctness: issuance, validation, expiry, rotation, and failure-mode handling for JWT/JWKS and SAML assertions.

- Apply strong applied-cryptography and PKI practices (X.509 certs, key rotation, TLS) to keep the auth path secure by default, not as an afterthought.

- Build and maintain reverse-proxy/HTTP-layer components (TLS termination, header handling) that front customer authentication traffic.

- Debug and resolve customer-facing identity/access issues, working with support to triage escalations quickly.

- Contribute to build/release and cross-platform packaging (Linux deb/rpm, Windows MSI) as needed.

- Maintain a small Windows companion application written in C#/.NET.

- Write and enhance end-to-end tests covering auth flows, failure modes, and edge cases (clock skew, revoked tokens, malformed assertions, etc.).

- Document known issues, workarounds, and design decisions in the team knowledge base as the team and product mature.

- Communicate clearly with product and engineering stakeholders on design tradeoffs, security posture, and escalation status.

Requirements

Must-have

- Strong hands-on programming skills in Golang.

- Deep, practical knowledge of identity protocols: OIDC/OAuth 2.0 and SAML 2.0 — including token/assertion internals, standard flows, and failure modes.

- Working knowledge of Active Directory.

- Applied cryptography/PKI experience: X.509, JWT/JWKS, key rotation, TLS.

- Strong security engineering discipline — comfortable reasoning about threat models and building software to protect mission-critical systems, not just make features work.

- Solid understanding of OS fundamentals, networking, and concurrency.

- Working knowledge of Linux; comfortable writing shell/bash scripts.

- Simple, effective written and verbal communication.

Nice-to-have

- Directory internals (schema, bind operations).

- HTTP internals and reverse proxying (TLS, header injection).

- Build/release and cross-platform packaging (Linux deb/rpm, Windows MSI).

- Secret-manager internals, Redis, Win32, policy engines.

- Basic C#/.NET (to maintain the companion app).