# Senior Software Engineer - Identity & Authorization Platform

**Company:** [Clickhouse](https://hotfix.jobs/companies/clickhouse)
**Location:** Remote
**Role:** Backend Engineering
**Salary:** $141k – $232k/yr
**Experience:** 4+ years
**Skills:** Go, Rust, C++, TypeScript, Python, SAML, SCIM, OIDC, Oauth2, RBAC, Rebac, Zanzibar, Openfga, Spicedb, Cedar
**Posted:** 2026-06-22

> Design and build authentication, authorization, and audit platform services including RBAC/ReBAC, token issuance, and SDKs. Requires 4+ years building production backend systems at scale and hands-on experience implementing auth services.

## Job Description

## What you will be doing

- Design and build the platform services that power authentication, authorization, and audit across ClickHouse Cloud. This includes a unified RBAC/ReBAC service, token issuance and session handling, and the SDKs that product teams embed to make authorization decisions.
- Model permissions and access control primitives (resources, roles, relationships, policies) that work across ClickHouse, SQL Console, ClickPipes, and HyperDX. Ship the libraries and APIs that other engineers build against.
- Implement protocol-level support for SAML, SCIM, OIDC, OAuth2, and MFA/passwordless flows. Own the integrations that make enterprise SSO and provisioning work end to end.
- Build the audit and authorization-decision telemetry pipeline so every access decision is observable, queryable, and surfaceable to customers.
- Partner with product engineering teams to migrate bespoke per-product auth implementations onto the shared platform, and design APIs that make adoption straightforward.
- Carry the platform on-call rotation and own production reliability for systems on the critical path of every customer request.

## What you bring along

- Minimum 4+ years building production backend systems at scale. Comfort with at least one systems language (Go, Rust, C++) and one application language (TypeScript, Python).
- Hands-on experience designing and implementing an authentication or authorization service. Examples include building a token issuer, an OIDC or OAuth2 provider, a policy engine, a permissions model, or an FGA/ReBAC system in the style of Zanzibar, OpenFGA, SpiceDB, or Cedar.
- Working knowledge of SAML, SCIM, OIDC, and OAuth2 at the protocol level and are able to implement them.
- Experience designing APIs and SDKs that other engineers depend on, with strong opinions on what makes them adoptable.
- Experience operating distributed systems at scale, including caching strategies, consistency tradeoffs, and multi-region concerns.
- Familiarity with identity vendors (Auth0, WorkOS, AWS/GCP/Azure IAM) as building blocks you've extended or integrated into a larger platform.
- Strong production debugging instincts and a high bar for systems that are easy to develop against.

## Bonus

- You've built or contributed to a Zanzibar-style authorization system, or run an OpenFGA or SpiceDB deployment beyond the demo.
- You've designed a multi-tenant permission model that survived real customer requirements like custom roles, hierarchies, delegation, and ABAC attributes.
- You've shipped an SDK that product teams across an org actually adopted, and have opinions about why most internal SDKs fail.

## Similar roles

- [Senior Software Engineer - JVM Language Clients](https://hotfix.jobs/jobs/c05c6a08-fef1-41be-89d0-c55b2f9ffbe4) - Clickhouse - Remote - $141k – $232k/yr
- [Software Engineer (L3)](https://hotfix.jobs/jobs/9b2edd79-2fd5-4687-a952-20d92bb76c02) - Twilio - Remote - $142k – $208k/yr
- [Senior Software Engineer](https://hotfix.jobs/jobs/cdd1d73d-3132-472b-a7f7-57becdfbe52c) - ZoomInfo - Waltham, MA - $140k – $220k/yr
- [Sr. Software Engineer II, Exchange Connectivity](https://hotfix.jobs/jobs/ab84cc7e-8e7b-42f2-aad3-ade27856e063) - NinjaTrader - Chicago, IL - $140k – $190k/yr
- [Senior Software Engineer - Customer Integrations](https://hotfix.jobs/jobs/b13dfb99-3b50-4700-b1d0-9622e4b2ef34) - TheGuarantors - Remote - $140k – $160k/yr

**Apply:** https://hotfix.jobs/jobs/3542a579-20c9-4d08-acb9-30ebc31d173d
**Canonical:** https://hotfix.jobs/jobs/3542a579-20c9-4d08-acb9-30ebc31d173d