Senior Software Engineer - Identity & Authorization Platform

ClickHouse
EMEA
Full timeFunction: Software EngineeringExperience: 4+ yearsSkills: ["Production debugging","Systems thinking","Reliability focus","Collaboration"]

Design and build the identity and authorization platform services for ClickHouse Cloud, including unified RBAC/ReBAC, token issuance, session handling, and SDKs that product teams embed. Model permissions and access-control primitives across ClickHouse and related products, implement SAML/SCIM/OIDC/OAuth2 and MFA flows, and deliver end-to-end enterprise SSO and provisioning. Own telemetry for auditability and production reliability through on-call rotation.

Loading

Loading job details...

Preparing the role view and application actions.

FursaFursa
ClickHouse
ClickHouse
2 months ago

Senior Software Engineer - Identity & Authorization Platform

✓ Verified Job

Canonical indexed version, validated from employer's careers page.

Source: Company careers pageValidated by: Fursa AI
Last checked: 5 hours agoStatus: Live

Job Summary

Design and build the identity and authorization platform services for ClickHouse Cloud, including unified RBAC/ReBAC, token issuance, session handling, and SDKs that product teams embed. Model permissions and access-control primitives across ClickHouse and related products, implement SAML/SCIM/OIDC/OAuth2 and MFA flows, and deliver end-to-end enterprise SSO and provisioning. Own telemetry for auditability and production reliability through on-call rotation.
Location: EMEA
Employment Type: Full time
Job Function: Software Engineering
Seniority: Mid level

Key Responsibilities

  • •Design and build platform services that power authentication, authorization, and audit across ClickHouse Cloud, including unified RBAC/ReBAC and session handling.
  • •Model permissions and access-control primitives (resources, roles, relationships, policies) and ship libraries/APIs that other engineers build against.
  • •Implement protocol-level support for SAML, SCIM, OIDC, OAuth2, and MFA/passwordless flows, owning enterprise SSO and provisioning integrations end to end.
  • •Build an audit and authorization-decision telemetry pipeline so access decisions are observable, queryable, and surfaceable to customers.
  • •Partner with product engineering teams to migrate per-product auth onto the shared platform and design adoption-friendly APIs, plus cover on-call and reliability for critical systems.

Pay and Benefits

Perks:Health InsuranceEquityRemote WorkHome OfficeFlexible Time

Key Requirements

  • •Minimum 4+ years building production backend systems at scale.
  • •Comfort with at least one systems language (Go, Rust, C++) and one application language (TypeScript, Python).
  • •Hands-on experience designing and implementing an authentication or authorization service (e.g., token issuer, policy engine, OIDC/OAuth2 provider, permissions model, FGA/ReBAC).
  • •Working knowledge of SAML, SCIM, OIDC, and OAuth2 at the protocol level, able to implement them.
  • •Experience operating distributed systems at scale, including caching, consistency tradeoffs, and multi-region concerns.
Experience:4+ yearsBackendDistributed systemsAuthenticationAuthorizationIdentity & access managementEnterprise SSORBACRBAC/ReBAC
Skills:Production debuggingSystems thinkingReliability focusCollaboration
Tech Stack:GoRustC++TypeScriptPythonSAMLSCIMOIDCOAuth2MFARBACReBACToken issuanceSession handlingSDKsAudit telemetryZanzibarOpenFGASpiceDBCedar

Company Brief

ClickHouse
Develops ClickHouse, a high-performance open-source columnar database for real-time analytics, enabling fast querying and processing of large volumes of data for analytics, monitoring, and business intelligence workloads.
Industry: Data Infrastructure
Headquarters: Menlo Park, United States
Founded: 2016
WebsiteLinkedIn