Senior Systems Engineer, Identity & Access Management

Build and operate high-throughput authentication and authorization services for Cloudflare’s global control plane. The role requires 5–8 years of production systems experience, strong distributed-systems judgment, and hands-on expertise with identity protocols, Go, TypeScript, PostgreSQL, and Redis.

About the job

Responsibilities

Design and build high-throughput, low-latency IAM capabilities powering customer-facing and internal service APIs.
Contribute to authentication and authorization systems and their evolution into modern, distributed, edge-capable architectures.
Translate product and security requirements into robust APIs and technical specifications with Product, Security, and UX teams.
Maintain engineering quality through code reviews, technical design documents, and collaborative problem-solving.
Own platform reliability under constant load, including observability and resilience.
Use AI tools for code generation, debugging, and other development workflows with sound judgment.

Requirements

5–8 years building and operating production systems at scale.
Working knowledge of OAuth 2.0, OIDC, SAML, SCIM, RBAC, ABAC, and session management.
Experience implementing identity protocols or fine-grained authorization systems, including RBAC, ABAC, relationship-based access control, or policy engines such as Cedar, in production.
Proficiency in Go and TypeScript.
Experience designing and building REST APIs, including routing, authentication, request lifecycles, and versioning.
Experience with PostgreSQL and Redis, including schema design, query optimization, caching strategies, and consistency tradeoffs.
Strong distributed-systems understanding, including consistency models, event-driven replication, and global state propagation.
High standards for correctness and security; curiosity, self-direction, and comfort driving ambiguous cross-team problems.

Nice-to-haves

Experience with credential and token lifecycle systems, including issuance, rotation, scoping, revocation, or service-to-service authentication at scale.
Familiarity with Cloudflare Workers, Durable Objects, KV, and R2.
Experience re-architecting large, long-lived codebases under production traffic.
Familiarity with Docker, Kubernetes, Terraform, Prometheus, Grafana, and Kibana.

Compensation and Benefits

Applicants who reach the offer stage may be asked to attend an in-person interview at a Cloudflare office or hub.
The position may require access to information protected under U.S. export control laws; employment may be conditioned on authorization to receive controlled software or technology without export-license sponsorship.