Staff Software Engineer

This is a build role, not a security-review role. You will write production code, design backend services, and integrate with access-control systems across GCP, Kubernetes, and Kafka. The security background is required because the product you are building is security-critical - mistakes are access breaches or audit failures. Strong bias toward shipping working software over designing perfect systems. Your primary focus for the first six months is the Just-In-Time (JIT) Access Portal: an internal product that becomes the single entry point for elevated access across every system in the platform. After establishing that, you rotate into other engineering areas - contributing to the compliance evidence layer, CI/CD security hardening - expanding your footprint across the broader platform. What You Will Do First Six Months - JIT Portal Build

• Own the JIT portal from design through production. Inherit and extend the foundation already established by the existing Staff Engineer.
• Extend portal coverage to Kafka ACLs via the Kafka admin client; SQL grants via GCP CloudSQL IAM; internal admin UI surfaces.
• Design and ship the TTL-enforcement mechanism across all backend systems — the hardest engineering problem in this area, because different access-control systems have different revocation semantics.
• Build the audit log pipeline: access events → Kafka → InfluxDB → Grafana. SOC2 access-control evidence view available to the GRC team on demand.
• Integrate with the incident tool: emergency break-glass access automatically granted at incident-open and revoked at incident-close.

Next Six Months - Expanding Scope

• Own the compliance evidence layer: map incidents to SOC2/ISO controls; auto-collect evidence artifacts at incident-close (ticket, post-mortem document, access logs, deployment manifest); generate audit dossiers on demand.
• Connect the compliance layer to the access-portal audit log and the configuration-management audit log — one continuous evidence trail covering access, configuration change, and incident response.
• Contribute to CI/CD security hardening: container image signing (Cosign), SBOM generation and storage, External Secrets Operator rollout, tfsec/Checkov in Terraform pipelines, CVE gating in the build pipeline.

Ongoing

• Contribute to cross-team architecture reviews with a security and identity lens - flag credential handling issues, ACL gaps, and audit-log omissions.
• Maintain the JIT portal as a production system - it is part of the platform team’s on-call rotation.
• Write and maintain design documents and runbooks for everything you build.

Requirements What We Are Looking For

• 8+ years of backend software engineering with a strong identity and access-management focus
• Has built or substantially contributed to an identity or access platform - not just used IAM tools, but written the code behind access grants, revocations, and audit pipelines
• Production experience with at least three of: GCP IAM, Kubernetes RBAC, Kafka ACLs, OAuth2/OIDC, SAML 2.0, Google Workspace admin APIs
• Understanding of SOC2 control requirements from an engineer’s perspective - specifically the access-control and change-management control families
• Strong backend engineering in Java or Go - the portal backend is Java/Spring Boot to match the broader platform stack
• Comfortable being the primary security engineering expertise in a team without a dedicated security function above you

Nice to Have

• Experience with zero-trust access architectures or enterprise Privileged Access Management products - understanding their failure modes helps in building our own
• Background with Cosign, Sigstore, or container image signing infrastructure
• Familiarity with Erlang or willingness to integrate at an application-gateway layer - Mnesia does not have native ACLs, so enforcement happens at the gateway
• Experience evaluating commercial JIT tools before deciding to build - familiarity with what Teleport, StrongDM, Britive, or CyberArk do well and where they fall short
• Has worked in a compliance-adjacent engineering environment where audit evidence is a first-class deliverable