Staff Engineer

Overview

Staff Engineer on AlphaSense's User Management team, which owns the full identity lifecycle (user management, authentication and authorization) for the company's customer base. The role is based in North America and works closely with the Helsinki-based core team.

What you'll do

• Design, build, and evolve the authorization platform (RBAC/ABAC/ReBAC) so teams across the company can answer "what can this user do?"
• Design, build, and evolve the authentication platform, covering authentication patterns across the range of use cases and working closely with the Auth0 integration.
• Design, build, and evolve the user management platform for creating, provisioning, and managing user identities and entitlements, supporting the entire customer base.
• Partner closely with security teams to ensure authentication, authorization, and user management are secure by design and aligned with SOC2 and GDPR requirements.
• Design and implement highly scalable systems that keep pace with a constantly growing number of users and customers.
• Help define the long-term roadmap across authentication, authorization, and user management, not just execute against one handed to you.
• Build self-service systems and APIs (GraphQL, gRPC, REST) that make authentication, authorization, and user data consumable by product engineering teams.
• Drive projects autonomously from North America while staying closely aligned with the Helsinki-based team.
• Champion strong testing, observability, and reliability practices across the platform.

What you'll need

• Genuinely senior, self-sufficient engineer with strong experience building and operating identity, authentication, or authorization platforms at scale, ideally in a platform/product-platform engineering context.
• Backend: Java 2X, Spring Boot 3.X.X, WebFlux, Maven.
• Data and APIs: SQL, GraphQL, gRPC, REST.
• Cloud and infrastructure: AWS, GCP, Kubernetes, Helm.
• Identity and security protocols: RBAC/ABAC/ReBAC; OAuth 2.0, OIDC, and JWT; SAML 2.0 and enterprise SSO federation (assertion validation, signature/encryption handling, IdP- vs. SP-initiated flows); SCIM for user provisioning and deprovisioning.
• Engineering practices: event-driven architecture patterns; TDD or a genuine passion for automated testing.

Nice to have

• Auth0 experience.
• SpiceDB / Zanzibar-style authorization system experience.
• Apollo Federation.
• OpenTelemetry.
• Experience operating within SOC2 and/or GDPR-compliant environments.

Details

• Location: Remote, United States.
• Collaborates with a core team based in Helsinki, Finland, in a distributed, cross-timezone setup.
• Compensation range: $202,400 to $278,300 USD.