Senior Software Engineer – Identity & Authorization Platform

This is a fully remote position, open to applicants in Canada.

📋 Description

• Develop and construct the platform services that enable authentication, authorization, and auditing across ClickHouse Cloud. This encompasses a cohesive RBAC/ReBAC service, token generation and session management, as well as the SDKs utilized by product teams to facilitate authorization decisions.

• Design models for permissions and access control elements (resources, roles, relationships, policies) that function seamlessly across ClickHouse, SQL Console, ClickPipes, and HyperDX. Deliver the libraries and APIs that other engineers will utilize.

• Execute protocol-level implementation for SAML, SCIM, OIDC, OAuth2, and MFA/passwordless workflows. Oversee the integrations that ensure enterprise SSO and provisioning operate smoothly from start to finish.

• Construct the audit and authorization-decision telemetry pipeline, ensuring that every access decision is observable, queryable, and accessible to customers.

• Collaborate with product engineering teams to transition custom per-product authentication implementations to the shared platform, designing APIs that facilitate straightforward adoption.

• Participate in the platform on-call rotation and take ownership of production reliability for systems critical to customer requests.

⛳️ Requirements

• At least 4 years of experience in building production backend systems at scale. Proficiency in at least one systems language (Go, Rust, C++) and one application language (TypeScript, Python).

• Practical experience in designing and implementing an authentication or authorization service. This could involve creating a token issuer, an OIDC or OAuth2 provider, a policy engine, a permissions model, or an FGA/ReBAC system similar to Zanzibar, OpenFGA, SpiceDB, or Cedar.

• Solid understanding of SAML, SCIM, OIDC, and OAuth2 at the protocol level, with the ability to implement them effectively.

• Experience in designing APIs and SDKs that are relied upon by other engineers, with strong insights into what makes them easily adoptable.

• Experience in operating distributed systems at scale, including knowledge of caching strategies, consistency trade-offs, and multi-region considerations.

• Familiarity with identity providers (Auth0, WorkOS, AWS/GCP/Azure IAM) as foundational components you've extended or integrated into a broader platform.

• Strong debugging instincts in a production environment and a high standard for systems that are developer-friendly.

🏝️ Benefits

• Flexible work environment - ClickHouse is a globally distributed company that supports remote work. Currently, we operate in over 20 countries.

• Healthcare - Employer contributions towards your healthcare coverage.

• Equity in the company - Every new team member receives stock options upon joining.

• Time off - Flexible time off policies in the US, with generous entitlements in other countries.

• A $500 budget for home office setup for remote employees.

• Global Gatherings – We value the importance of in-person connections and provide opportunities for engagement with colleagues during company-wide offsite events.