Staff Software Engineer, Identity & Access Management

Role Description

We are looking for a Staff Software Engineer, Identity & Access Management , to serve as the technical authority for identity, authentication, and authorization across the SimSpace platform. The ideal candidate will possess deep expertise in designing and building secure, scalable software systems, a strong foundation in modern IAM concepts, and the ability to drive technical direction across teams in a complex, security-focused environment.

In this position, you'll own the architecture and technical strategy for the IAM stack, partnering with engineering teams across the organization to establish authn/authz standards and ensure consistent, secure access patterns throughout the SimSpace platform. The focus is on software engineering leadership — designing and building the services that underpin identity and access management at SimSpace, solving hard problems, and raising the engineering bar across the team. Specifically, this position will be responsible for:

• Identity Provider architecture and service development built on Keycloak
• Authorization policy design and enforcement using a Relationship-Based Access Control (ReBAC) model implemented in Topaz/OPA
• Design and development of IAM-adjacent services including directory services, user management, and other platform integrations that augment the core identity stack
• Cross-team authn/authz standards, patterns, and platform integrations

What will you be doing as a Staff Software Engineer, IAM at SimSpace?

• Define and own the technical architecture for authentication and authorization across the SimSpace platform, ensuring systems are secure, scalable, and maintainable.
• Lead the design and development of Keycloak-based identity infrastructure, including federation, SSO, token management, and multi-tenant identity flows.
• Design and build the authorization layer for the SimSpace platform, including policy enforcement using a ReBAC model, authorization services, and the software infrastructure needed for consistent access control.
• Design and build new services that extend and augment the IAM stack, including directory services and user management services.
• Establish and evangelize cross-team authn/authz standards, providing technical guidance to engineering teams.
• Partner with technical leaders to translate business and security requirements into technical roadmaps and implementation plans.
• Lead project scoping and estimation for new initiatives, breaking down ambiguous requirements into well-defined work.
• Identify and drive resolution of systemic technical risk, performance bottlenecks, and security gaps within the IAM stack.
• Actively contribute to architectural review processes, raising the quality bar across the broader engineering organization.
• Mentor and grow senior engineers on the IAM team, sharing expertise in software design, identity protocols, and security patterns.

Qualifications

• Experienced Staff or Senior Software Engineer with a strong background in building platform or infrastructure services.
• Proven ability to design, build, and ship production-grade distributed services.
• Solid understanding of authentication protocols (OAuth 2.0, OIDC, SAML) and authorization patterns.
• Experience with Keycloak or comparable identity providers is a plus.
• Demonstrated ability to drive technical standards and architectural decisions across multiple teams.
• Strong project scoping and estimation instincts.
• Strong communicator who can translate complex security and identity concepts.
• Proficient in modern software engineering practices: API design, service decomposition, testing strategies, and CI/CD.
• Experience with Kubernetes and modern container-based infrastructure.
• Comfortable operating with ambiguity.
• Experience working in security-sensitive or compliance-driven environments is a strong plus.

Benefits

• Base salary range: $185,000 - $260,000, with opportunities for annual bonuses.
• Comprehensive medical, dental, and vision benefits, with coverage starting on day one.
• Access to company-paid counseling, coaching, and resources for mental health support.
• 401(k)-retirement savings plan featuring a company match.
• Unlimited vacation and dedicated health & wellness days.
• Paid parental leave plans.
• Equity stock options at hire, with annual performance-based grants.
• Referral rewards of $1,500–$3,500 for every qualified hire.
• Full- and partial-subsidized Peloton membership plans and equipment discounts.
• Access to a LinkedIn Learning membership for personal and professional development.
• Monthly reimbursements for meaningful connections with teammates.
• Legal plan coverage, pet insurance, wellness reimbursements, and more.