Description
The Platform Auth team's goal is to support ClickHouse's 'one customer identity' vision by providing tools, processes, and expertise for engineering teams to create a unified access management experience.
You will be designing and building platform services that power authentication, authorization, and audit across ClickHouse Cloud. This includes a unified RBAC/ReBAC service, token issuance and session handling, and SDKs that product teams embed to make authorization decisions.
Responsibilities:
- Design and build platform services for authentication, authorization, and audit
- Model permissions and access control primitives that work across multiple products
- Implement protocol-level support for SAML, SCIM, OIDC, OAuth2, and MFA/passwordless flows
- Build the audit and authorization-decision telemetry pipeline
- Partner with product engineering teams to migrate bespoke auth implementations onto the shared platform
- Carry the platform on-call rotation and own production reliability
Requirements:
- Minimum 4+ years building production backend systems at scale
- Comfort with at least one systems language (Go, Rust, C++) and one application language (TypeScript, Python)
- Hands-on experience designing and implementing an authentication or authorization service
- Working knowledge of SAML, SCIM, OIDC, and OAuth2 at the protocol level
- Experience designing APIs and SDKs that other engineers depend on
- Experience operating distributed systems at scale
Bonus skills:
- Built or contributed to a Zanzibar-style authorization system
- Designed a multi-tenant permission model that survived real customer requirements
- Shipped an SDK that product teams across an org actually adopted
Perks:
- Flexible work environment
- Remote-friendly
- Healthcare
- Equity in the company
- Time off
- Home office setup
- Global Gatherings