Staff Software Engineer, IDSM

Overview

Lead the technical direction of Domino's Identity and Access platform (IDSM), evolving it into a centralized, relationship-based authorization framework built on SpiceDB as the technical anchor for its next phase.

What you'll do

• Extend a centralized, fine-grained, relationship-based authorization model across the platform, replacing feature-specific permission checks with consistent, reusable primitives.
• Harden the authorization layer for the scale, reliability, and security that enterprise and public-sector customers expect.
• Make the sequencing and design decisions that allow legacy access checks to be retired without disrupting customers.
• Rethink how groups and organizational hierarchies are modeled so large enterprises can represent their teams as they actually work.
• Deepen integration with cloud workload identity, starting with AWS IRSA and extending to Azure and GCP equivalents.
• Design core identity and access capabilities, with clean interfaces and flexible abstractions, that engineers across the company can adopt with confidence.
• Set the patterns for how the team uses AI-assisted development to ship high-quality features faster without compromising security or code quality.
• Design identity and access solutions that meet customer demands for managing user and group access, and are secure, scalable, and built on reusable primitives.
• Articulate architecture clearly enough that the rest of Engineering can rally around it.
• Serve as the go-to authority for engineers and teams building on IDSM on auth questions.
• Lead design reviews, unblock engineers facing ambiguity, and champion flexible abstractions and well-thought-out interfaces.
• Improve architecture, including removing tech debt, so the team ships faster with less ongoing maintenance.
• Establish patterns for using AI-assisted development to deliver high-quality features faster without compromising security or rigor.
• Help the team decide what to build and value both quality and speed of iteration.

What you'll need

• A track record of evolving an enterprise-grade authorization system under real production traffic, with strong opinions about the architecture of these systems.
• Experience on a platform team supporting other services within a larger engineering organization.
• A concrete example of an auth system you helped build that solved a recurring class of customer challenges.
• A history of helping teams become better engineers by improving designs, velocity, and quality.
• Hands-on experience with relationship-based or fine-grained authorization, including schema design (relations, permissions, caveats) and the tradeoffs versus traditional RBAC.
• Solid grounding in OIDC and SAML.
• Practical experience with workload identity patterns such as AWS IRSA, Azure Workload Identity, or GCP Workload Identity Federation.
• Strong Go, Java, or a comparable language.
• Comfort running services on Kubernetes.
• API design instincts from owning a platform others build on.
• Experience architecting auth frameworks that scale to enterprise customers.
• Considered, real-world experience using AI coding tools while maintaining code quality and security rigor.

Nice to have

• Experience designing a new auth system and migrating to it from a legacy approach.
• A background at a company that builds authentication or authorization products.
• Ideally, experience with an IdP such as Keycloak, Auth0, Okta, or ForgeRock.
• Familiarity with a credential management system such as Vault.

Details

• Location: Remote US, Canada, Argentina.
• Annual US base salary range: $200,000 to $235,000 USD, to be narrowed during the interview process.
• Additional benefits may include equity, company bonus, 401(k) plan, medical, dental and vision benefits, and wellness stipends.