[![Image]() Meet Jobicy Copilot — free AI autofill for job applications + remote job alerts ›](#)   [All remote jobs](https://jobicy.com/jobs.md)Open role[![Kong Inc. logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2022/03/f43352b801f4c6854ba70c5f70cec7cd.jpeg)](https://jobicy.com/company/kong-inc.md)Remote opportunity at[Kong Inc.](https://jobicy.com/company/kong-inc.md)

# Staff Software Engineer, Identity and Access Management

Review the role, location requirements, compensation details, and application process before deciding whether this opportunity fits your next career move.

[Apply for this job](#job-application)[View company](https://jobicy.com/company/kong-inc.md)Share17 Sep 2026Published37Listing views2Application actions17 Oct 2026Apply before  Opportunity details

## About this role.

AI SummaryKong is seeking a Staff Software Engineer to architect and build Kong Identity, a multi-tenant identity and access management platform within its Konnect product team. The role focuses on highly scalable authentication, token lifecycle management, OAuth/OIDC extensions, federation, client management, and enterprise-grade security controls. The engineer will lead technical strategy across global infrastructure, observability, developer tooling, compliance, and privacy-preserving identity capabilities. This is a senior technical leadership role requiring deep hands-on expertise in distributed systems, identity protocols, cryptography, and regulated enterprise environments.

## Role DNA

A quick view of the complexity, pace, ownership and collaboration implied by the job description.

### Job Complexity

5/5EasyHard

### Pace & Pressure

5/5RelaxedFast-paced

### Autonomy Level

5/5GuidedFull ownership

### Communication Load

5/5IndependentCollaborative

AI insightThis is a staff-level architecture role for a globally distributed identity platform handling high-volume, security-sensitive authentication workloads. It demands rare depth across IAM standards, cryptography, multi-tenancy, performance engineering, compliance, and cross-team technical leadership.

## Salary analysis

Estimated compensation compared with the broader CA market for similar roles.

Estimated job medianMarket rateC$204,743CA market rangeC$165k–C$260k0C$286k

AI insightThe disclosed yearly base salary range is CAD 163,685 to CAD 245,800, with a midpoint of CAD 204,742.50. A competitive Canadian market range for a Staff Software Engineer specializing in IAM and distributed security platforms is estimated at CAD 165,000 to CAD 260,000 annually; the offer is well aligned with this senior, specialized market segment.

## Core skills

Skills and capabilities most closely associated with this opportunity.

[Identity and Access Management](https://jobicy.com/jobs?search_keywords=Identity%20and%20Access%20Management.md)[OAuth 2.0](https://jobicy.com/jobs?search_keywords=OAuth%202.0.md)[OpenID Connect](https://jobicy.com/jobs?search_keywords=OpenID%20Connect.md)[SAML Federation](https://jobicy.com/jobs?search_keywords=SAML%20Federation.md)[JWT](https://jobicy.com/jobs?search_keywords=JWT.md)[Multi-tenant Architecture](https://jobicy.com/jobs?search_keywords=Multi-tenant%20Architecture.md)[Distributed Systems](https://jobicy.com/jobs?search_keywords=Distributed%20Systems.md)[Cryptography](https://jobicy.com/jobs?search_keywords=Cryptography.md)[Zero Trust Security](https://jobicy.com/jobs?search_keywords=Zero%20Trust%20Security.md)[API Platform Engineering](https://jobicy.com/jobs?search_keywords=API%20Platform%20Engineering.md)

Sample interview questionsHow would you design refresh-token rotation with real-time revocation for a multi-tenant identity platform?I would issue short-lived access tokens and one-time-use refresh tokens bound to a token family, client, tenant, and relevant device or proof-of-possession context. Each refresh request atomically rotates the token and records lineage; reuse of an older token triggers family revocation and security telemetry. A low-latency distributed revocation store, local cache with bounded TTL, and event-driven invalidation would support near-real-time enforcement across regions.

What trade-offs would you consider when implementing globally distributed token validation?

I would keep the common validation path local by using signed JWTs, regionally replicated public keys, and carefully bounded caches. Stateful requirements such as revocation, session risk, and dynamic policy checks need an explicit consistency model, with risk-based decisions about whether to fail closed or tolerate brief replication lag. I would measure p99 latency, key-propagation time, revocation convergence, availability, and security impact before selecting the design.

How would you enforce tenant isolation in a complex enterprise IAM system?

Isolation should be layered across the data model, authorization layer, encryption boundaries, APIs, caches, queues, and observability data. Every request must have an authenticated tenant context enforced centrally, with tenant-scoped identifiers and policy checks that cannot be bypassed by downstream services. I would also use automated negative testing, audit trails, and threat modeling to validate that cross-tenant access is impossible under failure and misuse scenarios.

How would you approach adding an extensibility model for custom grant flows without weakening the platform's security posture?

I would provide a constrained plugin contract with explicit input/output schemas, least-privilege capabilities, execution limits, versioning, and tenant-level policy controls. Plugins should run in an isolated environment and be subject to signing, review, audit logging, and deterministic failure behavior. The core authorization server must retain control of credential validation, token signing, issuer rules, and security-critical claims.

Describe how you would lead a compliance-focused identity initiative such as SOC 2, FedRAMP, or GDPR readiness.

I would translate control requirements into concrete architecture, operational, and evidence requirements early, rather than treating compliance as a final audit task. This includes immutable audit trails, data classification, retention and residency controls, access reviews, incident response integration, and documented change management. I would partner with security, legal, SRE, and product teams to prioritize gaps, define measurable controls, and continuously collect evidence through automation.

Are you ready to unlock intelligence?

If you don’t think you meet all of the criteria below but are still interested in the job, please apply. Nobody checks every box – we’re looking for candidates that are particularly strong in a few areas, and have some interest and capabilities in others.

About the Role:
Kong is building the future of API management for developers. We’re a fast-growing, well-funded company with happy customers and motivated employees. Insomnia, acquired in 2019, is a full-lifecycle API development platform that has quickly become an integral part of Kong’s product portfolio.
As a Staff Software Engineer on the Konnect team at Kong, you’ll architect Kong Identity’s multi-tenant identity platform supporting complex organizational hierarchies, cross-tenant isolation, and enterprise-grade security controls.

What You’ll Do:

*

Design and implement advanced token management systems, including refresh token rotation, proof-of-possession tokens, and custom token introspection with real-time revocation capabilities.

*

Lead development of Kong Identity’s extensible claims engine supporting dynamic attribute resolution, contextual claim injection, and complex business logic evaluation at token issuance.

*

Architect global identity infrastructure with edge optimization, intelligent token caching, and cross-region replication strategies for sub-millisecond authentication latency worldwide.

*

Design sophisticated rate limiting, anomaly detection, and fraud prevention systems to protect against credential stuffing, token abuse, and distributed attacks.

*

Build enterprise identity federation capabilities, including SAML bridge patterns, external IdP chaining, and custom protocol adapters for legacy system integration.

*

Lead technical strategy for Kong Identity’s developer experience, including SDKs, webhooks, audit logging, and real-time analytics dashboards for token lifecycle visibility.

*

Architect advanced client management systems supporting dynamic client registration, automated credential rotation, and programmatic policy enforcement.

*

Design Kong Identity’s plugin architecture enables custom grant flows, protocol extensions, and third-party integrations while maintaining security boundaries.

*

Drive implementation of compliance frameworks (SOC 2, FedRAMP, GDPR), including comprehensive audit trails, data residency controls, and privacy-preserving token designs.

*

Lead technical initiatives for Kong Identity’s integration with observability platforms, supporting distributed tracing, metrics collection, and security event correlation.

*

Mentor engineering teams on advanced identity concepts including zero-trust architectures, workload identity, and service mesh integration patterns.

What You’ll Bring:

*

7+ years of experience building production identity platforms at leading identity providers or enterprise software companies, with proven track record of handling millions of authentication requests daily.

*

Deep expertise in advanced OAuth 2.0 extensions (PKCE, mTLS, JWT bearer assertions, token exchange), OpenID Connect profiles, and emerging standards like OAuth 2.1 and GNAP.

*

Proven experience architecting multi-tenant identity platforms with complex isolation requirements, tenant-specific configurations, and enterprise feature sets.

*

Strong background in cryptographic protocols including advanced JWT patterns, key rotation strategies, Hardware Security Module (HSM) integration, and post-quantum cryptography considerations.

*

Experience building identity platforms with sophisticated analytics, real-time monitoring, and security event detection capabilities at enterprise scale.

*

Expertise in global identity infrastructure including edge deployment strategies, geo-distributed token validation, and cross-region data consistency patterns.

*

Deep understanding of enterprise identity integration patterns including SAML federation, LDAP/AD bridges, SCIM provisioning, and custom protocol adapters.

*

Proven track record building developer-first identity platforms including comprehensive SDKs, webhook systems, and extensible API designs.

*

Experience with identity platform security including threat modeling, penetration testing coordination, and implementation of advanced attack prevention mechanisms.

*

Strong background in compliance and regulatory requirements for identity systems including audit trail design, data residency controls, and privacy engineering.

*

Experience building identity platforms supporting complex organizational structures, delegated administration, and fine-grained permission models.

*

Expertise in high-performance system design including horizontal scaling strategies, caching architectures, and latency optimization for identity operations.

*

Knowledge of service mesh identity patterns, workload identity bootstrapping, and integration with container orchestration platforms.

*

Experience with identity protocol extensions, custom grant flows, and building extensible identity platforms that support diverse use cases.

*

Proven ability to lead technical initiatives in complex, regulated environments while balancing innovation with security and compliance requirements.

#LI-AW1

About Kong:

Kong Inc., the AI Connectivity Company, is building the connectivity layer of AI. Trusted by the Fortune 500® and AI-native startups alike, Kong’s unified API and AI platform enables organizations to secure, manage, accelerate, govern, and monetize the flow of intelligence across APIs and AI traffic — on any model, any cloud. For more information, visit [www.konghq.com](http://www.konghq.com).

Show more

[Apply now >](https://jobicy.com/jobs/153501-staff-software-engineer-identity-and-access-management.md)

*

![Upload CV](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI2NSIgaGVpZ2h0PSI2NSIgZmlsbD0ibm9uZSIgeG1sbnM6dj0iaHR0cHM6Ly92ZWN0YS5pby9uYW5vIj48ZyBjbGlwLXBhdGg9InVybCgjQSkiPjxwYXRoIGQ9Ik0wIDBINjVWNjVIMFYwWiIgZmlsbD0iIzAyOWFlYiIvPjxnIGZpbGw9IiNmZmYiIHN0cm9rZT0iI2ZmZiIgc3Ryb2tlLXdpZHRoPSIyIj48cGF0aCBkPSJNMzMuMDQ5IDE1LjQ1NGExLjQzIDEuNDMgMCAwIDAtMi4wOTcgMGwtNy41NzkgOC4xNDdhMS4zOCAxLjM4IDAgMCAwIC4wOSAxLjk3MyAxLjQ0IDEuNDQgMCAwIDAgMi4wMDgtLjA4OGw1LjEwOS01LjQ5MnYyMC42MWExLjQxIDEuNDEgMCAwIDAgMS40MjEgMS4zOTdjLjc4NSAwIDEuNDIxLS42MjUgMS40MjEtMS4zOTd2LTIwLjYxbDUuMTA5IDUuNDkyYTEuNDQgMS40NCAwIDAgMCAyLjAwOC4wODggMS4zOCAxLjM4IDAgMCAwIC4wOS0xLjk3M2wtNy41NzktOC4xNDZ6TTE2Ljc2OSAzOC40YzAtLjc3My0uNjItMS40LTEuMzg1LTEuNFMxNCAzNy42MjcgMTQgMzguNHYuMTAybC4yMTUgNi4yMjljLjIyMyAxLjY4LjcwMSAzLjA5NSAxLjgxMyA0LjIxOHMyLjUxIDEuNjA3IDQuMTcyIDEuODMzYzEuNi4yMTggMy42MzYuMjE4IDYuMTYuMjE4aDExLjI4bDYuMTYtLjIxOGMxLjY2Mi0uMjI2IDMuMDYxLS43MDkgNC4xNzItMS44MzNzMS41ODktMi41MzggMS44MTMtNC4yMThDNTAgNDMuMTEzIDUwIDQxLjA1NSA1MCAzOC41MDNWMzguNGMwLS43NzMtLjYyLTEuNC0xLjM4NS0xLjRzLTEuMzg1LjYyNy0xLjM4NSAxLjRsLS4xOSA1Ljk1OGMtLjE4MiAxLjM3LS41MTUgMi4wOTUtMS4wMjYgMi42MTJzLTEuMjI4Ljg1My0yLjU4MyAxLjAzOGMtMS4zOTUuMTktMy4yNDMuMTkzLTUuODkzLjE5M0gyNi40NjJjLTIuNjUgMC00LjQ5OC0uMDAzLTUuODkzLS4xOTMtMS4zNTUtLjE4NC0yLjA3Mi0uNTIxLTIuNTgzLTEuMDM4cy0uODQ0LTEuMjQyLTEuMDI2LTIuNjEyYy0uMTg3LTEuNDEtLjE5MS0zLjI3OS0uMTkxLTUuOTU4eiIvPjwvZz48L2c+PGRlZnM+PGNsaXBQYXRoIGlkPSJBIj48cGF0aCBmaWxsPSIjZmZmIiBkPSJNMCAwaDY1djY1SDB6Ii8+PC9jbGlwUGF0aD48L2RlZnM+PC9zdmc+)

### Upload your resume now

To unlock remote work opportunities and be discovered by global employers.

This job listing has been manually reviewed by the Jobicy Trust & Safety Team for compliance with our posting guidelines, including verification of the company's legitimacy, accuracy of job details, clarity of remote work policy, and absence of misleading or fraudulent content.

Next step

## Apply now.

Follow the employer’s application method and review Jobicy’s safety guidance before sharing personal information.

Keep exploring

## Related remote jobs.

Matched by job category10 related opportunities[Software Engineering](https://jobicy.com/categories/engineering.md) [Browse all jobs](https://jobicy.com/jobs.md)
*
![Truelogic logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/e7ae6cb6-221-1.png)
Truelogic  Sep 17

### [Senior Software Architect (C#/Angular/AI First) – GovTech SaaS company](https://jobicy.com/jobs/153535-senior-software-architect-c-angular-ai-first-govtech-saas-company.md)

About Truelogic At Truelogic we are a leading provider of nearshore staff augmentation services headquartered in New York. For over two decades, we’ve been delivering top-tier technology solutions to companies…

*
![Truelogic logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/e7ae6cb6-221-1.png)
Truelogic  Sep 17

### [Forward Deployed Engineer (AI & Business Transformation) – Technology & Creative Network | Brazil](https://jobicy.com/jobs/153531-forward-deployed-engineer-ai-business-transformation-technology-creative-network-brazil.md)

About Truelogic At Truelogic we are a leading provider of nearshore staff augmentation services headquartered in New York. For over two decades, we’ve been delivering top-tier technology solutions to companies…

*
![Cloudbeds logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/3aef1a38-221.png)
Cloudbeds  Sep 17

### [Senior Software Engineer – Workflow](https://jobicy.com/jobs/153534-senior-software-engineer-workflow.md)

What Makes Cloudbeds UniqueAt Cloudbeds, we’re not just building software, we’re transforming hospitality. Our intelligently designed platform powers properties across 150 countries, processing billions in bookings annually. From independent properties…

*
![Truelogic logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/e7ae6cb6-221-1.png)
Truelogic  Sep 17

### [Senior Full-stack Engineer (Python/React) – Advertising](https://jobicy.com/jobs/153536-senior-full-stack-engineer-python-react-advertising-2.md)

About Truelogic At Truelogic we are a leading provider of nearshore staff augmentation services headquartered in New York. For over two decades, we’ve been delivering top-tier technology solutions to companies…

*
![Truelogic logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/e7ae6cb6-221-1.png)
Truelogic  Sep 17

### [Forward Deployed Engineer (AI & Creative Transformation) – Marketing](https://jobicy.com/jobs/153530-forward-deployed-engineer-ai-creative-transformation-marketing-2.md)

About Truelogic At Truelogic we are a leading provider of nearshore staff augmentation services headquartered in New York. For over two decades, we’ve been delivering top-tier technology solutions to companies…

*
![Cloudbeds logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/3aef1a38-221.png)
Cloudbeds  Sep 17

### [Senior Software Engineer](https://jobicy.com/jobs/153532-senior-software-engineer-9.md)

What Makes Cloudbeds UniqueAt Cloudbeds, we’re not just building software, we’re transforming hospitality. Our intelligently designed platform powers properties across 150 countries, processing billions in bookings annually. From independent properties…

*
![Truelogic logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/e7ae6cb6-221-1.png)
Truelogic  Sep 17

### [Forward Deployed Engineer (AI & Business Transformation) – Technology & Creative Network | Mexico](https://jobicy.com/jobs/153533-forward-deployed-engineer-ai-business-transformation-technology-creative-network-mexico.md)

About Truelogic At Truelogic we are a leading provider of nearshore staff augmentation services headquartered in New York. For over two decades, we’ve been delivering top-tier technology solutions to companies…

*
![PerfectServe logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2022/04/7e6f5669fc8c9ea0aa484ce7c3058599.jpg)
PerfectServe  Sep 17

### [QA Engineer – US Remote](https://jobicy.com/jobs/153516-qa-engineer-us-remote.md)

What is PerfectServe? PerfectServe is a leading provider of clinical communication and physician scheduling solutions in the health IT space. The company was founded in 1997 and has grown steadily…

*
![Kong Inc. logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2022/03/f43352b801f4c6854ba70c5f70cec7cd.jpeg)
Kong Inc.  Sep 17

### [Forward Deployed Engineer](https://jobicy.com/jobs/153504-forward-deployed-engineer-5.md)

Are you ready to unlock intelligence? If you don’t think you meet all of the criteria below but are still interested in the job, please apply. Nobody checks every box…

*
![Mural logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2022/01/9b6f1383-221.jpeg)
Mural  Sep 17

### [Senior Software Engineer, Integrated Workflows](https://jobicy.com/jobs/153500-senior-software-engineer-integrated-workflows.md)

ABOUT THE TEAM The Integrated Workflows team exists to expand Mural’s value by embedding it seamlessly into the essential business workflows our customers already live in. We connect Mural to…