Senior Software Engineer – Identity & Authorization Platform

This is a fully remote position, open to applicants in United States.

📋 Description

• Develop and construct the platform services that drive authentication, authorization, and auditing across ClickHouse Cloud. This encompasses a consolidated RBAC/ReBAC service, token generation, session management, and the SDKs that product teams integrate to facilitate authorization decisions.

• Design access control primitives and permissions models (resources, roles, relationships, policies) that function seamlessly across ClickHouse, SQL Console, ClickPipes, and HyperDX. Deliver the libraries and APIs that other engineers utilize for their development.

• Implement protocol-level capabilities for SAML, SCIM, OIDC, OAuth2, and MFA/passwordless mechanisms. Take ownership of the integrations that ensure enterprise SSO and provisioning operate smoothly from start to finish.

• Establish the telemetry pipeline for auditing and authorization decisions so that every access choice is observable, queryable, and accessible to customers.

• Collaborate with product engineering teams to transition custom per-product authentication implementations to the shared platform, while designing APIs that simplify adoption.

• Participate in the platform on-call rotation and take responsibility for production reliability concerning systems that are vital to every customer interaction.

⛳️ Requirements

• At least 4+ years of experience in constructing production backend systems at scale. Proficient in at least one systems language (Go, Rust, C++) and one application language (TypeScript, Python).

• Proven experience in designing and implementing an authentication or authorization service. This includes developing a token issuer, an OIDC or OAuth2 provider, a policy engine, a permissions model, or an FGA/ReBAC system akin to Zanzibar, OpenFGA, SpiceDB, or Cedar.

• Solid understanding of SAML, SCIM, OIDC, and OAuth2 at the protocol level with the capability to implement them effectively.

• Experience in designing APIs and SDKs that are essential for other engineers, with strong insights on what enhances their adoptability.

• Background in operating distributed systems at scale, covering caching strategies, consistency trade-offs, and multi-region considerations.

• Familiarity with identity providers (Auth0, WorkOS, AWS/GCP/Azure IAM) as building blocks that you have extended or integrated into a larger framework.

• Exceptional production debugging skills and a high standard for systems that are user-friendly for developers.

🏝️ Benefits

• Flexible work environment - ClickHouse is a globally distributed company and remote-friendly. We currently operate in over 20 countries.

• Healthcare - Employer contributions towards your healthcare.

• Equity in the company - Every new team member who joins our company receives stock options.

• Time off - Flexible time off in the US, generous entitlement in other countries.

• A $500 Home office setup if you’re a remote employee.

• Global Gatherings – We believe in the power of in-person connection and offer opportunities to engage with colleagues at company-wide offsites.