Staff Software Engineer, Identity & Authorization
About this role
Designing, building, and operating identity and authorization systems forms the core of daily operations, protecting critical product and service interactions across the platform. Engineers on the Product Platform team build shared foundations that enable other developers to ship features safely and quickly, focusing heavily on agentic workflows and secure delegation. Someone who thrives in a small, collaborative environment and values clear reasoning and direct problem-solving will succeed here.
Replit operates the agentic software creation platform enabling application building through natural language. The Identity and Authorization group defines how people, agents, sandboxes, and services prove identity and permissions across web, mobile, enterprise controls, and internal services. The role exists to establish high-leverage security primitives so product teams can move fast without rebuilding controls.
What you will do
- Design and operate central authorization interfaces with typed principals, actions, resources, decisions, and privilege attenuation.
- Evolve enterprise roles, groups, app access, entitlements, and workspace policy for simple and advanced cases.
- Build and operate the Security Token Service and workload identity using OAuth 2.0 token exchange, JWT/OIDC, SPIFFE/SPIRE, and mTLS.
- Threat-model delegation, confused-deputy risks, and cross-tenant movement to ensure secure, fail-closed behavior.
- Lead compatible migrations using shadow evaluation, feature gates, telemetry, and rollback plans while owning operational health and SLOs.
- Partner with Agent, Connectors, Enterprise, Security, and Infrastructure teams to translate product requirements into shared platform primitives.
What you need
- Experience shipping and operating security-sensitive backend or distributed systems in production, covering reliability, performance, incidents, and observability.
- Depth in authentication, authorization, or identity systems such as OAuth 2.0/OIDC, JWT, mTLS, Identity Federation, RBAC, ReBAC, PBAC, Zanzibar, or policy engines.
- Strong understanding of multi-tenant security, least privilege, delegation, privilege attenuation, auditability, and threat modeling.
- Experience migrating security-sensitive systems without breaking callers through typed contracts, shadow evaluation, and staged enforcement.
- Fluency in at least one production backend stack.
- Ability to make and communicate tradeoffs across security, reliability, latency, product experience, delivery speed, and maintainability.
Benefits
- Competitive Salary & Equity
- 401(k) Program with a 4% match
- Health, Dental, Vision and Life Insurance
- Short Term and Long Term Disability
- Paid Parental, Medical, Caregiver Leave
- Flexible Time Off (FTO) + Holidays
Skills and tech stack
Questions candidates ask
What tech stack does the team use?
Systems are built using TypeScript, Go, Rust, Postgres, gRPC/Protobuf, Kubernetes, Envoy, and Restate. The work also involves standards like OAuth 2.0, JWT/OIDC, SPIFFE/SPIRE, and mTLS.
What does the Identity and Authorization team actually do?
The team defines how people, agents, sandboxes, and services prove who they are and what they can do. These systems protect critical product and service interactions across the web product, Agent, enterprise controls, and internal services.
What benefits are included with the position?
Full-time employees receive competitive salary and equity, a 401(k) program with a 4% match for US workers, and health, dental, vision, and life insurance. Additional benefits include short and long term disability, paid parental leave, flexible time off, commuter benefits, and a monthly wellness stipend.