Staff Software Engineer, Identity and Authorization

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Staff Software Engineer, Identity and Authorization based in Canada. Join a high-impact engineering team building secure, scalable identity and access management capabilities for enterprise AI and data science platforms. In this staff-level role, you will shape the architecture of a centralized authorization framework that helps organizations control access to sensitive resources with precision and consistency. You will drive the evolution toward relationship-based authorization, modernize legacy permission systems, and strengthen security and reliability for enterprise and public-sector environments. Working across platform engineering, cloud infrastructure, and application teams, you will establish reusable foundations that other engineers can build on confidently. You will also influence technical strategy, improve engineering practices, and help teams adopt AI-assisted development without compromising code quality or security. This is an opportunity to solve complex distributed systems challenges while enabling customers to operate AI and data science workloads securely at scale. Accountabilities - Define and lead the technical architecture for identity and authorization services, building a centralized, fine-grained, relationship-based authorization framework using SpiceDB and reusable permission primitives. - Evolve enterprise authorization capabilities to support complex user, group, resource, and organizational relationships while replacing fragmented, feature-specific permission checks with consistent platform-wide patterns. - Strengthen the production readiness of authorization services by addressing scalability, reliability, performance, security, and operational requirements for enterprise and public-sector customers.

- Plan and execute the migration from legacy access control mechanisms to the centralized authorization framework, making sound architectural decisions that minimize disruption and preserve customer trust. - Design improved group and organizational hierarchy models that reflect complex enterprise structures and support flexible, accurate access management. - Expand cloud-native identity capabilities by integrating workload identity patterns, starting with AWS IAM Roles for Service Accounts (IRSA) and extending support to Azure and Google Cloud Platform equivalents. - Establish clean APIs, flexible abstractions, and reusable identity capabilities that enable other engineering teams to integrate authorization into their services effectively. - Serve as a technical authority for identity and authorization, guiding architectural decisions, clarifying complex trade-offs, and helping engineers resolve challenging design and implementation issues. - Lead design reviews, improve engineering standards, reduce technical debt, and promote maintainable solutions that increase development velocity while minimizing ongoing operational effort. - Develop and promote responsible AI-assisted engineering practices that accelerate implementation and testing while preserving security, correctness, and code quality. - Collaborate across engineering teams to prioritize identity and access management improvements, foster ownership, and deliver intuitive user and organizational management experiences. Requirements: - Proven experience designing, developing, and evolving enterprise-grade authorization systems operating under real production workloads, with strong judgment regarding architecture, scalability, and security. - Hands-on expertise in fine-grained or relationship-based authorization, including schema design for relations, permissions, and caveats, as well as an understanding of the trade-offs compared with traditional role-based access control (RBAC).