Staff Software Engineer - IAM (Platform Engineering)

Qcells North America is seeking a Staff Software Engineer – IAM to architect, design, and build Identity and Access Management services for their multi-tenant SaaS platform. The role involves owning the architecture and implementation of authentication, authorization, and identity services while collaborating closely with various teams to ensure secure and scalable identity capabilities.

Responsibilities:

• Architect, design, and implement IAM platform services enabling authentication and authorization across the SaaS product
• Define and own IAM architecture: identity boundaries, trust models, access patterns, token lifecycles
• Build scalable services supporting OAuth 2.0, OIDC, SAML, and SCIM
• Develop APIs, SDKs, and tooling for safe, intuitive consumption by product teams
• Apply least‑privilege and Zero Trust principles across users, services, and infrastructure
• Lead technical decision‑making with clear tradeoffs across security, usability, and performance
• Partner with Security and Compliance for SOC 2, ISO 27001, and NIST alignment
• Drive incident response and root‑cause analysis for identity‑related issues
• Mentor engineers and elevate IAM engineering practices and platform reliability

Requirements:

• 10+ years of software engineering experience, including 4+ years building IAM systems
• Deep expertise with SAML, OAuth 2.0, OIDC, SCIM
• Bachelor's or Master's degree in Computer Science, Engineering, or related field (or equivalent experience)
• Experience integrating with IAM platforms (Entra ID, Okta, Ping Identity, ForgeRock) as an engineer, not an administrator
• Expert‑level proficiency in one or more backend languages (e.g., Java, C#) and in building production services (testing, observability, performance)
• Experience with cloud platforms (Azure, AWS, or GCP) and Infrastructure as Code (Terraform, ARM, CloudFormation)
• Familiarity with Zero Trust, least privilege, CI/CD, DevSecOps
• Experience with distributed systems and containers (Docker, Kubernetes)
• Ability to travel up to 10%
• Experience building IAM capabilities for multi‑tenant SaaS (tenant isolation, per‑tenant config, scale)
• Background in platform engineering, identity platforms, or security infrastructure engineering
• Understanding of compliance frameworks (SOC 2, ISO 27001, NIST)