Senior Software Engineer - Identity & Authorization Platform

Details

ClickHouse is seeking engineers to join its Platform Auth team, which supports the company's "one customer identity" vision by providing tools, processes, and expertise for unified access management across engineering teams.

Responsibilities

• Design and build platform services for authentication, authorization, and audit across ClickHouse Cloud, including a unified RBAC/ReBAC service, token issuance, session handling, and SDKs for authorization decisions.
• Model permissions and access-control primitives, including resources, roles, relationships, and policies, across ClickHouse, SQL Console, ClickPipes, and HyperDX.
• Ship libraries and APIs for use by other engineering teams.
• Implement protocol-level support for SAML, SCIM, OIDC, OAuth2, and MFA/passwordless flows.
• Own integrations supporting enterprise SSO and provisioning end to end.
• Build audit and authorization-decision telemetry pipelines so access decisions are observable, queryable, and available to customers.
• Partner with product engineering teams to migrate bespoke authentication implementations to the shared platform.
• Design APIs that make platform adoption straightforward.
• Participate in the platform on-call rotation and own production reliability for systems on the critical path of customer requests.

Requirements

• At least 4 years of experience building production backend systems at scale.
• Proficiency with at least one systems language, such as Go, Rust, or C++, and one application language, such as TypeScript or Python.
• Hands-on experience designing and implementing an authentication or authorization service, such as a token issuer, OIDC or OAuth2 provider, policy engine, permissions model, or FGA/ReBAC system in the style of Zanzibar, OpenFGA, SpiceDB, or Cedar.
• Working knowledge of SAML, SCIM, OIDC, and OAuth2 at the protocol level, with the ability to implement them.
• Experience designing APIs and SDKs used by other engineers.
• Experience operating distributed systems at scale, including caching strategies, consistency tradeoffs, and multi-region concerns.
• Familiarity with identity vendors such as Auth0, WorkOS, and AWS, Google Cloud, or Azure IAM.
• Strong production debugging skills and a focus on systems that are easy to develop against.

Bonus Qualifications

• Experience building or contributing to a Zanzibar-style authorization system, or operating an OpenFGA or SpiceDB deployment beyond a demo.
• Experience designing a multi-tenant permission model supporting custom roles, hierarchies, delegation, and ABAC attributes.
• Experience shipping an SDK adopted by product teams across an organization.

Compensation

The typical starting salary in the United States is $141,000–$208,000 USD. In US premium markets, including the San Francisco Bay Area and New York City Metro Area, the typical starting salary is $157,000–$232,000 USD. Actual compensation depends on factors including education, qualifications, certifications, experience, skills, location, performance, and business needs.

Benefits

• Flexible, remote-friendly work environment.
• Employer healthcare contributions.
• Company stock options.
• Flexible time off in the United States and generous entitlement in other countries.
• $500 home-office setup allowance for remote employees.
• Opportunities to participate in company-wide offsites and global gatherings.

Equal Opportunity

ClickHouse provides equal employment opportunities and prohibits discrimination and harassment based on legally protected characteristics.