Software Engineer - Identity & Access Management

Responsibilities:

• Design, build, and harden identity and access flows OIDC/OAuth 2.0 SAML 2.0 LDAP/Active Directory integrations that sit in front of mission-critical systems.
• Own token and assertion lifecycle correctness: issuance, validation, expiry, rotation, and failure-mode handling for JWT/JWKS and SAML assertions.
• Apply strong applied-cryptography and PKI practices (X. 509 certs, key rotation, TLS) to keep the auth path secure by default, not as an afterthought.
• Build and maintain reverse-proxy/HTTP-layer components (TLS termination, header handling) that front customer authentication traffic.
• Debug and resolve customer-facing identity/access issues, working with support and sales to triage escalations quickly.
• Contribute to build/release and cross-platform packaging (Linux deb/rpm, Windows MSI) as needed.
• Maintain a small Windows companion application written in C#/. NET.
• Write and enhance end-to-end tests covering auth flows, failure modes, and edge cases (clock skew, revoked tokens, malformed assertions, etc. ).
• Document known issues, workarounds, and design decisions in the team knowledge base as the team and product mature.
• Communicate clearly with product and engineering stakeholders on design tradeoffs, security posture, and escalation status.

Requirements:

• Strong hands-on programming skills in Golang.
• Deep, practical knowledge of identity protocols: OIDC/OAuth 2.0 and SAML 2.0 including token/assertion internals, standard flows, and failure modes.
• Working knowledge of LDAP/Active Directory.
• Applied cryptography/PKI experience: X. 509 JWT/JWKS, key rotation, TLS.
• Strong security engineering discipline, comfortable reasoning about threat models and building software to protect mission-critical systems, not just make features work.
• Solid understanding of OS fundamentals, networking, and concurrency.
• Working knowledge of Linux; comfortable writing shell/bash scripts.
• Simple, effective written and verbal communication.

Nice-to-have:

• Directory internals (LDAP schema, bind operations).
• HTTP internals and reverse proxying (TLS, header injection).
• Build/release and cross-platform packaging (Linux deb/rpm, Windows MSI).
• Secret-manager internals, Redis, Win32 policy engines.
• Basic C#/. NET (to maintain the companion app).