# Senior Software Engineer - Identity & Authorization Platform

**Company:** [Clickhouse](https://hotfix.jobs/companies/clickhouse)
**Location:** Remote
**Role:** Backend Engineering
**Experience:** 5+ years
**Skills:** Go, Rust, C++, TypeScript, Python, RBAC, Rebac, SAML, SCIM, OIDC, Oauth2, Openfga, Spicedb, Distributed Systems
**Posted:** 2026-06-22

> Build and operate ClickHouse Cloud’s shared identity and authorization platform, including policy services, enterprise identity protocols, SDKs, and audit telemetry. The role requires 4+ years of backend experience, strong systems and application programming skills, and hands-on authentication or authorization expertise.

## Job Description

## Responsibilities
- Design and build platform services for authentication, authorization, and auditing across ClickHouse Cloud.
- Develop unified RBAC/ReBAC services, token issuance, session handling, and SDKs for product teams.
- Model resources, roles, relationships, and policies across ClickHouse, SQL Console, ClickPipes, and HyperDX.
- Implement protocol-level support for SAML, SCIM, OIDC, OAuth2, and MFA/passwordless authentication flows.
- Build audit and authorization-decision telemetry pipelines that make access decisions observable and queryable.
- Partner with product engineering teams to migrate bespoke authentication implementations to the shared platform.
- Participate in the platform on-call rotation and own production reliability for critical systems.

## Requirements
- 4+ years building production backend systems at scale.
- Proficiency in at least one systems language: Go, Rust, or C++.
- Proficiency in at least one application language: TypeScript or Python.
- Hands-on experience designing and implementing authentication or authorization services, such as token issuers, OIDC/OAuth2 providers, policy engines, permissions models, or FGA/ReBAC systems.
- Working knowledge of SAML, SCIM, OIDC, and OAuth2 at the protocol level.
- Experience designing APIs and SDKs used by other engineers.
- Experience operating distributed systems at scale, including caching, consistency tradeoffs, and multi-region concerns.
- Familiarity with identity platforms such as Auth0, WorkOS, AWS IAM, Google Cloud IAM, or Azure IAM.
- Strong production debugging and reliability skills.

## Nice-to-haves
- Experience building or contributing to a Zanzibar-style authorization system, or operating OpenFGA or SpiceDB in production.
- Experience designing multi-tenant permission models with custom roles, hierarchies, delegation, and ABAC attributes.
- Experience shipping an SDK broadly adopted by product teams.

## Compensation and Benefits
- Equity through company stock options.
- Healthcare contributions.
- Flexible time off in the United States and generous leave entitlement in other countries.
- USD $500 home office setup allowance for remote employees.
- Opportunities to attend company-wide offsites.

## Similar jobs

- [Senior Software Engineer, Device Identity](https://hotfix.jobs/jobs/bd779c69-a026-4775-949d-bff228853342) - Okta - Toronto, Canada - CA$136k – CA$187k/yr
- [Senior Software Engineer - Blockchain Network](https://hotfix.jobs/jobs/6bf255ac-877f-49f8-8b24-9cfd16e461a9) - Coinbase - Remote - $186k – $219k/yr
- [Senior Distributed Systems Engineer - Cache](https://hotfix.jobs/jobs/31ea1a78-08f2-4384-af35-6c61f496377c) - Cloudflare - Atlanta, GA - $168k – $231k/yr
- [Senior Software Engineer - Backend](https://hotfix.jobs/jobs/97f20d9c-9d33-43c9-82ef-4f3238a01789) - Hinge Health - San Francisco, CA - $158k – $238k/yr
- [Senior Software Engineer - Network Connectivity](https://hotfix.jobs/jobs/7e93331b-f15f-435f-b97b-7543be4018bb) - Cloudflare - Lisbon, Portugal - $66k – $91k/yr

**Apply:** https://hotfix.jobs/jobs/dab3be96-c067-4033-8295-859113ff5043
**Canonical:** https://hotfix.jobs/jobs/dab3be96-c067-4033-8295-859113ff5043