Suggested rewrite: Led a cross-functional initiative that improved [business outcome] by [measurable result], demonstrating experience relevant to this role...
Senior C++/iOS Engineer – User Platform
Review the role, location requirements, compensation details, and application process before deciding whether this opportunity fits your next career move.
- Salary
- Undisclosed
- Department
- Software Engineering
- Employment
- Full Time
- Experience
- Senior
- Published
- Apply before
- 17 Nov 2026
- Listing views
- 32
- Application actions
- 3
Make your next move.
Prepare your resume, explore your fit, and draft a cover letter for this opportunity.
The role, at a glance.
This senior engineering role develops Spotify's delegated authorization and session-management platforms used by mobile, desktop, and third-party integrations. The engineer will build shared C++ libraries and native Swift iOS components that support secure token issuance, refresh, revocation, credential storage, and session lifecycles. Success requires strong systems design, OAuth 2.0 knowledge, and the ability to collaborate with client, backend, and platform engineering teams. The role has high user impact, supporting secure access experiences for hundreds of millions of Spotify users. It is based in London or Stockholm with flexibility for working from home and some in-person meetings.
Role DNA
A quick view of the complexity, pace, ownership and collaboration implied by the job description.
Pace & Pressure
4/5Autonomy Level
5/5Communication Load
4/5Salary analysis
Estimated compensation compared with the broader US market for similar roles.
Core skills
Skills and capabilities most closely associated with this opportunity.
Sample interview questions
I would define clear ownership boundaries between the shared authorization logic and the iOS-native secure-storage layer. Refresh tokens would be stored in the iOS Keychain with appropriate accessibility controls, refresh requests would use rotation and revocation-aware handling, and the shared library would expose narrowly scoped APIs for state transitions, retries, and error classification. I would also account for concurrency, clock skew, offline behavior, telemetry, and safe recovery when a token is invalidated.
I focus on using the correct flow for public clients, PKCE, validated redirect URIs, state and nonce validation where applicable, short-lived access tokens, secure refresh-token storage, and protection against token leakage in logs or URLs. I also evaluate deep-link hijacking, replay attacks, compromised-device assumptions, certificate and transport protections, and robust handling of revocation or account changes.
I would start with an explicit compatibility strategy, stable public interfaces, versioned behavior where necessary, and a migration plan agreed with client owners. Changes would be protected by unit, integration, and contract tests across platform adapters, then released incrementally with observability and rollback options. Clear documentation and early communication are essential when shared code affects multiple release cycles and native environments.
I would first define the user-visible failure mode and correlate it with client version, platform, network conditions, authorization events, and backend responses. I would inspect privacy-safe traces around token refresh, storage reads and writes, clock handling, and revocation events, then attempt to reproduce the suspected state transitions with targeted tests. After identifying a cause, I would ship a measured fix with monitoring and safeguards to confirm that session recovery and error rates improve.
I treat security controls as product requirements while designing graceful, understandable recovery paths for expected failures. For example, tokens should be protected and aggressively invalidated when necessary, but transient network or storage errors should use bounded retries and preserve a valid session when safe. I would make trade-offs explicit through threat modeling, reliability metrics, and collaboration with security, product, and client teams.
About this role.
We’re looking for a Senior C++/iOS Engineer to join the Baldur squad within User Platform (UP). Baldur owns Spotify’s Session Management and Delegated Authorization domains—the systems that enable applications to securely obtain, use, and manage access tokens for hundreds of millions of users. In this role, you’ll help shape the technology that powers secure access across every Spotify client and third-party integration.
Your work will support engineers across Spotify building mobile and desktop experiences, platform teams, and third-party developers integrating with Spotify’s authorization platform. You’ll collaborate across disciplines to build secure, reliable, and scalable authentication experiences that have a direct impact on millions of people every day.
What You’ll Do
- Collaborate with a highly autonomous and supportive engineering squad responsible for Spotify’s delegated authorization and session management platforms.
- Design, build, and evolve critical infrastructure powering Spotify applications and partner integrations using shared C++ libraries and native Swift on iOS.
- Develop secure, reliable, and performant delegated authorization flows, including token issuance, refresh, revocation, and session lifecycle management across multiple platforms.
- Partner with client and backend engineers to integrate with core authorization services, token issuance, client registration, and token revocation.
- Improve how credentials and access tokens are securely stored and managed on-device while balancing security, reliability, and application performance.
- Contribute to the evolution of Spotify’s authorization frameworks, Spotify-specific implementations, enabling new platforms and product experiences.
- Drive technical improvements, share knowledge with teammates, and help shape the long-term technical direction of delegated authorization and session management.
Who You Are
- You have strong proficiency in C++, along with experience building native iOS applications in Swift, or you’re excited to develop your expertise in Swift while applying your C++ skills.
- You have experience designing, building, or maintaining security-sensitive systems such as authorization, authentication, token management, credential storage, or related platforms.
- You bring a systems-thinking mindset and enjoy solving complex engineering challenges that span client and backend technologies.
- You have a solid understanding of software architecture, secure system design, and modern authorization protocols such as OAuth 2.0.
- You approach problems thoughtfully, with strong attention to detail and a focus on building secure, reliable, and maintainable solutions.
- You communicate clearly and enjoy collaborating with engineers across multiple teams and technical disciplines.
- You have experience working with shared cross-platform codebases and understand how native platform layers interact with common C++ libraries.
- You enjoy working on large-scale distributed systems where your contributions improve experiences for hundreds of millions of Spotify users.
Where You’ll Be
- This role is based in London or Stockholm.
- We offer you the flexibility to work where you work best! There will be some in person meetings, but still allows for flexibility to work from home.
Compensation
Additional Information
Spotify is an equal opportunity employer. You are welcome at Spotify for who you are, no matter where you come from, what you look like, or what’s playing in your headphones. Our platform is for everyone, and so is our workplace. The more voices we have represented and amplified in our business, the more we will all thrive, contribute, and be forward-thinking! So bring us your personal experience, your perspectives, and your background. It’s in our differences that we will find the power to keep revolutionizing the way the world listens.
At Spotify, we are passionate about inclusivity and making sure our entire recruitment process is accessible to everyone. We have ways to request reasonable accommodations during the interview process and help assist in what you need. If you need accommodations at any stage of the application or interview process, please let us know – we’re here to support you in any way we can.
Annual salary information is not provided for this position. Explore salary ranges for similar roles in our Salary Directory ›
This job listing has been manually reviewed by the Jobicy Trust & Safety Team for compliance with our posting guidelines, including verification of the company's legitimacy, accuracy of job details, clarity of remote work policy, and absence of misleading or fraudulent content.
Apply now.
Follow the employer’s application method and review Jobicy’s safety guidance before sharing personal information.
Continue on the employer website
Protect your personal information and never pay to secure an interview or job offer. .
