Principal Platform Engineer || Identity Platform (AuthN/AuthZ)

Architecture, administration and product configuration alone are not sufficient. We want to understand what you personally implemented, tested, automated and supported in production.

We’re interested in what you have personally built and automated: how you provisioned it, tested changes, delivered it safely and enabled other teams to use it without depending on manual intervention. Identity and access is the domain you will work in; specialist experience in that domain is particularly welcome.

This is an opportunity to shape a critical platform capability, with substantial technical ownership and impact across our engineering organisation.

The job

We are hiring two Principal Platform Engineers to help unify authentication and authorisation across our next-generation enterprise software platform.

We are consolidating a fragmented authorisation landscape into one model across three hosting environments: our cloud-native platform, our legacy hosting platform and our lifecycle cloud. It must be correct, fast and reliable in distributed, multi-tenant environments.

Our current stack includes SpiceDB backed by PostgreSQL for authorisation, and Curity for authentication, with Keycloak estates migrating onto it. These describe the systems you will work on; prior experience with every product is not required.

You will design and build platform services, APIs and automation, own them in production, and establish patterns that product engineering teams can adopt confidently. A central part of the role is making secure authentication and authorisation available through documented, automated, self-service workflows.

This is a hands-on role. You will write and review infrastructure and automation code, build platform integrations, and contribute to tooling and services, including those written in Go.

What we need to see

Platform engineering and automation

• Software platforms or shared services you have built and operated for application engineering teams.
• Infrastructure code, automation, delivery pipelines, integrations or platform tooling you have personally built and maintained.
• Automation covering provisioning, configuration, deployment, upgrades and recovery, managed through version control and repeatable delivery pipelines.
• Self-service capabilities that reduce manual intervention and enable developers to work independently.
• Experience deploying and operating containerised application services on Kubernetes in a software delivery environment.

Authorisation

• Practical understanding of access control within applications and APIs, including role-based, attribute-based and relationship-based models.
• Experience implementing permission checks or designing permission models, with an understanding of tenant isolation and security boundaries.
• The ability to reason about correctness, latency, consistency and the traceability of authorisation decisions.
• Familiarity with fine-grained authorisation engines or policy-as-code approaches is valuable.

Authentication

• Practical understanding of authentication for software applications and services, including OAuth 2.0, OpenID Connect and token lifecycle management.
• Experience implementing or extending authentication flows in software, with an understanding of validation, trust boundaries and failure modes.
• Understanding of enterprise federation, SSO and external identity-provider integration in a customer-facing platform.
• Deeper experience engineering and operating authentication infrastructure at scale is particularly welcome.

Production ownership

• Experience with cloud infrastructure, Kubernetes, containers, GitOps and Infrastructure as Code.
• An approach to reliability that includes observability, performance testing, safe rollouts, rollback, backup and recovery.
• Examples of diagnosing production failures and using code or automation to prevent recurrence.
• Sound engineering judgement across distributed systems, relational data and event-driven services.

How we work

You will remain close to the code while helping other engineers make good architectural decisions. We value clear technical reasoning, constructive challenge and ownership from design through production.

We are interested in how AI-assisted engineering fits into your work: what you delegate, how you review and test the results, and how you remain accountable for the software you ship.

Must have — platform engineering

• Substantial hands-on experience building and operating platforms or shared infrastructure that support software engineering teams.
• Strong coding and scripting skills applied to infrastructure, automation, deployment tooling or integrations. You should be comfortable maintaining code, reviewing changes and using automated tests.
• Experience automating provisioning, configuration, deployment and operational tasks through version-controlled, repeatable workflows.
• Production experience with Kubernetes and containers in an environment delivering and operating software applications.
• Practical experience with a major public cloud platform, Infrastructure as Code, CI/CD and GitOps.
• Experience building reusable platform capabilities or self-service workflows that reduce manual work for engineering teams.
• Sound understanding of APIs, networking, data stores and distributed-system behaviour, with the ability to troubleshoot production issues.
• Evidence of technical leadership through design decisions, code reviews, engineering standards and support for other engineers.

Experience developing application or backend services is a strong advantage, but is not required. Your coding experience may come primarily from infrastructure and platform engineering. You should be willing to work with our Go-based tooling and services and develop your capabilities where needed.

Must have — authentication and authorisation foundations

• Practical experience implementing authentication and access control within software applications, APIs or shared platform services.
• Working knowledge of OAuth 2.0, OpenID Connect and token-based authentication, including secure validation and common failure modes.
• Understanding of permission models, least privilege and tenant isolation, and the ability to explain where access decisions are enforced.
• The ability to translate security requirements into working software, automated tests and maintainable platform capabilities.

We would particularly like to talk to you if…

• You have production experience with Curity, especially extending it, automating its configuration and lifecycle, or operating it as part of a software platform.
• You have engineered and operated Keycloak in a software product environment, including customisation, automated delivery or migrations.
• You have built fine-grained authorisation using SpiceDB or a comparable relationship-based authorisation engine.
• You have deeper experience with enterprise federation, SAML, policy-as-code or authentication and authorisation in distributed, multi-tenant systems.
• You have built self-service identity capabilities, APIs or SDKs that other engineering teams use.
• You have worked with Go, PostgreSQL and Kafka or RedPanda in production.

These are advantages, not substitutes for strong platform engineering, coding and automation skills. Strong platform engineers with relevant authentication and authorisation foundations are encouraged to apply even if they have not used our specific products.

We embrace flexibility and hybrid work opportunities to support diverse needs and lifestyles, while also valuing inclusive workplace experiences. By fostering a sense of community, we drive innovation, strengthen connections, and nurture belonging. Our commitment ensures you can work in a way that suits you best, while also engaging with colleagues to share ideas and build meaningful relationships.