Staff Engineer

Join AlphaSense as a Staff Engineer, where you'll play a crucial role in managing identity and access for our growing customer base. You'll work across all three pillars of identity: user creation and management, authentication, and authorization. Security is a core focus of this role, and you'll collaborate closely with our security teams to ensure our systems are secure by design. This position offers the opportunity to work from home and requires strong experience in building and operating identity, authentication, or authorization platforms at scale.

• Design, build, and evolve the authorization platform (RBAC/ABAC/ReBAC) to enable teams across the company to answer "what can this user do?"
• Design, build, and evolve the authentication platform, covering authentication patterns across a range of use cases, working closely with the Auth0 integration.
• Design, build, and evolve the user management platform, creating, provisioning, and managing user identities and entitlements to support the entire customer base.

• This is someone who doesn't just execute a roadmap, but helps understand the needs behind it, shapes it, and then drives execution — largely autonomously, and in close collaboration with our core team based in Helsinki
• We're looking for a genuinely senior, self-sufficient engineer with strong experience building and operating identity, authentication, or authorization platforms at scale, ideally in a platform/product-platform engineering context
• You're genuinely interested in security, comfortable partnering closely with security teams on secure-by-design systems, and comfortable working in a distributed, cross-timezone setup — based in North America, collaborating closely with a Helsinki-based team
• Backend: Java 2X, Spring Boot 3.X.X, WebFlux, Maven
• Cloud & Infrastructure: AWS, GCP, Kubernetes, Helm
• Engineering Practices: Event-driven architecture patterns; TDD or a genuine passion for automated testing
• Identity & Security Protocols: RBAC/ABAC/ReBAC; OAuth 2.0, OIDC, and JWT; SAML 2.0 and enterprise SSO federation (assertion validation, signature/encryption handling, IdP- vs. SP-initiated flows); SCIM for user provisioning and deprovisioning
• Data & APIs: SQL, GraphQL, gRPC, REST
• Auth0 experience
• SpiceDB / Zanzibar-style authorization system experience
• Apollo Federation
• OpenTelemetry
• Experience operating within SOC2 and/or GDPR-compliant environments