[All remote jobs](https://jobicy.com/jobs.md)[![Domino Data Lab logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2026/11/2b7332248704-221.webp)](https://jobicy.com/company/domino-data-lab.md)[Domino Data Lab](https://jobicy.com/company/domino-data-lab.md) # Staff Software Engineer, Identity and Authorization AI Summary Domino Data Lab is hiring a Staff Software Engineer to lead the evolution of its enterprise identity and authorization platform. The role centers on building a centralized, fine-grained authorization framework using SpiceDB, modern identity protocols, and cloud workload identity. This engineer will set architectural direction, guide migrations away from legacy access controls, and provide technical leadership to teams adopting the platform. The position requires strong backend engineering, Kubernetes, API design, and security architecture expertise. It also emphasizes pragmatic use of AI-assisted development without compromising security or code quality.[Apply for this job](#job-application)[View company](https://jobicy.com/company/domino-data-lab.md)ShareRemote from[Argentina](https://jobicy.com/job-region/argentina.md)SalaryUndisclosedDepartment[Cybersecurity](https://jobicy.com/categories/cybersecurity.md)EmploymentFull TimeExperienceSeniorPublished13 Nov 2026Apply before13 Dec 2026Listing views35Application actions1Application toolkit ## Make your next move. Prepare your resume, explore your fit, and draft a cover letter for this opportunity. Opportunity details ## About this role. Who we are At Domino, we build solutions that help the largest, highly regulated organizations adopt AI to accelerate mission-critical use cases. Our platform integrates a streamlined model and app development environment, advanced model, agent, and app hosting capabilities, and novel governance capabilities providing regulator-ready AI at scale. Our customers — like Johnson & Johnson, GSK, Bristol Myers, UBS, FINRA and the US Navy — are using our software to solve some of the most important challenges in the world, such as developing new medicines, securing our financial markets, or protecting our country. Backed by Sequoia Capital, Coatue Management, NVIDIA, Snowflake and other leading investors, we have been in business for over a decade but are still a small team operating with the spirit of a startup. In the world of AI today, we believe that the future is still being invented — and we want to be the ones building it. For more information, visit [www.domino.ai](http://www.domino.ai) What we are building Domino’s Identity and Access platform (IDSM) is the foundation for how customers in some of the world’s most regulated industries manage who can see and do what. We’re evolving it into a centralized, relationship-based authorization framework built on SpiceDB, and you’d be the technical anchor for its next phase. * A unified authorization model. Extend a centralized, fine-grained, relationship-based model across the platform, replacing feature-specific permission checks with consistent, reusable primitives. * Production-grade operations. Harden the authorization layer for the scale, reliability, and security that enterprise and public-sector customers expect. * A thoughtful migration path. Make the sequencing and design calls that let us retire legacy access checks without disrupting customers along the way. * Groups and organizations that mirror real customers. Rethink how we model groups and organizational hierarchies so large enterprises can represent their teams the way they actually work. * Cloud-native identity. Deepen integration with cloud workload identity, starting with AWS IRSA and extending to Azure and GCP equivalents. * Foundations other teams build on. Design core identity and access capabilities, with clean interfaces and flexible abstractions, that engineers across the company can adopt with confidence. * A stronger way of building. Set the patterns for how the team uses AI-assisted development to ship high-quality features faster, without compromising security or code quality. What your impact will be * Set the architectural direction. Design identity and access solutions that meet customer demands for managing user and group access, and are secure, scalable, and built on primitives teams can reuse. * Bring clarity to complex decisions. Articulate the architecture clearly enough that the rest of Engineering can rally around it. * Be the go-to authority. Engineers and teams building on IDSM will bring their auth questions to you, and your technical judgment will carry real influence. * Raise the engineering bar. Lead design reviews, unblock engineers facing ambiguity, and champion flexible abstractions and well-thought-out interfaces. * Increase velocity and reduce maintenance. Improve our architecture, including removing tech debt, so the team ships faster with less ongoing maintenance. * Shape how we build with AI. Establish patterns for using AI-assisted development to deliver high-quality features faster without compromising security or rigor. * Foster ownership and urgency. Help the team know what to build and value both quality and speed of iteration and contribute to experiences that make identity and user management easier for the enterprises we serve. What we look for in this role * A track record of evolving an enterprise-grade authorization system under real production traffic, with strong opinions about the architecture of these systems * Experience designing a new auth system and migrating to it from a legacy approach (a plus) * Experience on a platform team supporting other services within a larger engineering organization * A background at a company that builds authentication or authorization products (a plus) * A concrete example of an auth system you helped build that solved a recurring class of customer challenges * A history of helping teams become better engineers by improving designs, velocity, and quality * Authorization systems: Hands-on experience with relationship-based or fine-grained authorization, including schema design (relations, permissions, caveats) and the tradeoffs versus traditional RBAC * Identity protocols: Solid grounding in OIDC and SAML, and ideally experience with an IdP such as Keycloak, Auth0, Okta, or ForgeRock * Cloud identity: Practical experience with workload identity patterns such as AWS IRSA, Azure Workload Identity, or GCP Workload Identity Federation * Secrets management: Familiarity with a credential management system such as Vault * Backend engineering: Strong Go, Java, or a comparable language, comfort running services on Kubernetes, and API design instincts from owning a platform others build on * System architecture: Experience architecting auth frameworks that scale to enterprise customers * AI-assisted development: Considered, real-world experience using AI coding tools while maintaining code quality and security rigor What We Value * We value a growth mindset. High-performing creative individuals who dig into problems and see the opportunities for success * We believe in individuals who seek truth and speak the truth and can be their whole selves at work * We value all of you that believe improving is always possible At Domino Everything is a work in progress – we can do better at everything * We emphasize an environment of teaching and learning to equip employees with the tools needed to be successful in their function and the company * We strongly believe in the value of growing a diverse team and encourage people of all backgrounds, genders, ethnicities, abilities, and sexual orientations to apply #LI-Remote Show more [Apply now >](https://jobicy.com/jobs/161940-staff-software-engineer-identity-and-authorization.md) > Annual salary information is not provided for this position. Explore salary ranges for similar roles in our [Salary Directory ›](https://jobicy.com/salaries.md) * ![Upload CV](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI2NSIgaGVpZ2h0PSI2NSIgZmlsbD0ibm9uZSIgeG1sbnM6dj0iaHR0cHM6Ly92ZWN0YS5pby9uYW5vIj48ZyBjbGlwLXBhdGg9InVybCgjQSkiPjxwYXRoIGQ9Ik0wIDBINjVWNjVIMFYwWiIgZmlsbD0iIzAyOWFlYiIvPjxnIGZpbGw9IiNmZmYiIHN0cm9rZT0iI2ZmZiIgc3Ryb2tlLXdpZHRoPSIyIj48cGF0aCBkPSJNMzMuMDQ5IDE1LjQ1NGExLjQzIDEuNDMgMCAwIDAtMi4wOTcgMGwtNy41NzkgOC4xNDdhMS4zOCAxLjM4IDAgMCAwIC4wOSAxLjk3MyAxLjQ0IDEuNDQgMCAwIDAgMi4wMDgtLjA4OGw1LjEwOS01LjQ5MnYyMC42MWExLjQxIDEuNDEgMCAwIDAgMS40MjEgMS4zOTdjLjc4NSAwIDEuNDIxLS42MjUgMS40MjEtMS4zOTd2LTIwLjYxbDUuMTA5IDUuNDkyYTEuNDQgMS40NCAwIDAgMCAyLjAwOC4wODggMS4zOCAxLjM4IDAgMCAwIC4wOS0xLjk3M2wtNy41NzktOC4xNDZ6TTE2Ljc2OSAzOC40YzAtLjc3My0uNjItMS40LTEuMzg1LTEuNFMxNCAzNy42MjcgMTQgMzguNHYuMTAybC4yMTUgNi4yMjljLjIyMyAxLjY4LjcwMSAzLjA5NSAxLjgxMyA0LjIxOHMyLjUxIDEuNjA3IDQuMTcyIDEuODMzYzEuNi4yMTggMy42MzYuMjE4IDYuMTYuMjE4aDExLjI4bDYuMTYtLjIxOGMxLjY2Mi0uMjI2IDMuMDYxLS43MDkgNC4xNzItMS44MzNzMS41ODktMi41MzggMS44MTMtNC4yMThDNTAgNDMuMTEzIDUwIDQxLjA1NSA1MCAzOC41MDNWMzguNGMwLS43NzMtLjYyLTEuNC0xLjM4NS0xLjRzLTEuMzg1LjYyNy0xLjM4NSAxLjRsLS4xOSA1Ljk1OGMtLjE4MiAxLjM3LS41MTUgMi4wOTUtMS4wMjYgMi42MTJzLTEuMjI4Ljg1My0yLjU4MyAxLjAzOGMtMS4zOTUuMTktMy4yNDMuMTkzLTUuODkzLjE5M0gyNi40NjJjLTIuNjUgMC00LjQ5OC0uMDAzLTUuODkzLS4xOTMtMS4zNTUtLjE4NC0yLjA3Mi0uNTIxLTIuNTgzLTEuMDM4cy0uODQ0LTEuMjQyLTEuMDI2LTIuNjEyYy0uMTg3LTEuNDEtLjE5MS0zLjI3OS0uMTkxLTUuOTU4eiIvPjwvZz48L2c+PGRlZnM+PGNsaXBQYXRoIGlkPSJBIj48cGF0aCBmaWxsPSIjZmZmIiBkPSJNMCAwaDY1djY1SDB6Ii8+PC9jbGlwUGF0aD48L2RlZnM+PC9zdmc+) ### Upload your resume now To unlock remote work opportunities and be discovered by global employers. This job listing has been manually reviewed by the Jobicy Trust & Safety Team for compliance with our posting guidelines, including verification of the company's legitimacy, accuracy of job details, clarity of remote work policy, and absence of misleading or fraudulent content. ## Role DNA A quick view of the complexity, pace, ownership and collaboration implied by the job description. ### Job Complexity 5/5EasyHard ### Pace & Pressure 4/5RelaxedFast-paced ### Autonomy Level 5/5GuidedFull ownership ### Communication Load 5/5IndependentCollaborative AI insightThis is a staff-level platform security role involving architecture ownership, high-stakes migrations, and enterprise-grade authorization at scale. Success requires deep technical judgment as well as the ability to align multiple engineering teams around complex design decisions. ## Salary analysis Estimated compensation compared with the broader US market for similar roles. Estimated job median (per year)Market rate$210,000US market range (per year)$180k–$260k0$286k AI insightThe yearly pay period is inferred from the job context; it was not explicitly stated by the employer. No employer salary was disclosed. The annual USD figures are estimated market compensation for a Staff Software Engineer specializing in identity, authorization, and security platform architecture; the yearly period is inferred from the senior full-time role and standard market conventions. ## Core skills Skills and capabilities most closely associated with this opportunity. [Authorization architecture](https://jobicy.com/jobs?search_keywords=Authorization%20architecture.md)[Identity and access management](https://jobicy.com/jobs?search_keywords=Identity%20and%20access%20management.md)[SpiceDB](https://jobicy.com/jobs?search_keywords=SpiceDB.md)[Relationship-based access control](https://jobicy.com/jobs?search_keywords=Relationship-based%20access%20control.md)[OIDC](https://jobicy.com/jobs?search_keywords=OIDC.md)[SAML](https://jobicy.com/jobs?search_keywords=SAML.md)[AWS IRSA](https://jobicy.com/jobs?search_keywords=AWS%20IRSA.md)[Cloud workload identity](https://jobicy.com/jobs?search_keywords=Cloud%20workload%20identity.md)[Kubernetes](https://jobicy.com/jobs?search_keywords=Kubernetes.md)[Go](https://jobicy.com/jobs?search_keywords=Go.md)[API design](https://jobicy.com/jobs?search_keywords=API%20design.md)[Secrets management](https://jobicy.com/jobs?search_keywords=Secrets%20management.md)[Keycloak](https://jobicy.com/jobs?search_keywords=Keycloak.md)[AI-assisted development](https://jobicy.com/jobs?search_keywords=AI-assisted%20development.md) Sample interview questionsHow would you migrate a large platform from feature-specific permission checks to a centralized authorization system?I would first inventory existing authorization paths, define a target authorization model, and prioritize high-risk or high-value domains. I would introduce the new system behind stable interfaces, run dual-read or shadow evaluations where feasible, measure decision mismatches, and migrate incrementally with rollback controls. Clear ownership, observability, and customer-impact safeguards are essential throughout the transition. What are the key design considerations when modeling permissions in a relationship-based authorization system such as SpiceDB? The model should represent real business relationships clearly while keeping permission evaluation predictable and maintainable. I would define reusable relations and permissions, account for nested groups and organizational hierarchies, use caveats only where contextual policy is truly required, and test performance for high-cardinality relationships. I would also establish schema review practices and versioning to prevent policy drift. How would you secure workload-to-workload authentication on Kubernetes across AWS, Azure, and GCP? I would use short-lived federated workload identities rather than static credentials. On AWS, that means IRSA; on Azure, Workload Identity; and on GCP, Workload Identity Federation. The design should enforce least privilege, bind identities to service accounts and namespaces, rotate trust configurations safely, and provide auditable access paths across clouds. How do you balance platform flexibility with simplicity for internal engineering consumers? I start with common use cases and define a small set of durable primitives rather than exposing every underlying implementation detail. I validate API ergonomics with early adopter teams, provide strong defaults and documentation, and reserve extension points for demonstrated requirements. Platform success should be measured by safe adoption, reduced duplicated logic, and lower support burden. How would you use AI-assisted development in security-sensitive code without weakening engineering rigor? AI tools can accelerate drafting, refactoring, test generation, and documentation, but they should not replace engineering accountability. I would set guidance for approved use cases, require normal code review and security review, avoid exposing sensitive data to unapproved tools, and validate generated code through tests, static analysis, and threat modeling. The goal is faster delivery with explicit quality and security controls. Next step ## Apply now. Follow the employer’s application method and review Jobicy’s safety guidance before sharing personal information. Keep exploring ## Related remote jobs. * ![ANGI logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2021/09/50cccf084c34089de2274f72e18841d0.jpg) ANGI Nov 13 New ### [Senior Security Engineer, Detection & Response](https://jobicy.com/jobs/161962-senior-security-engineer-detection-response.md) For over 30 years, Angi has powered the future of the home services industry, creating an environment where homeowners and pros benefit from more jobs done well. For homeowners, our… * ![ANGI logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2021/09/50cccf084c34089de2274f72e18841d0.jpg) ANGI Nov 13 New ### [Senior Security Engineer, Application Security](https://jobicy.com/jobs/161957-senior-security-engineer-application-security.md) For over 30 years, Angi has powered the future of the home services industry, creating an environment where homeowners and pros benefit from more jobs done well. For homeowners, our… * ![Domino Data Lab logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2026/11/2b7332248704-221.webp) Domino Data Lab Nov 13 New ### [Senior Software Engineer, Patch Engineering & Vulnerability Remediation](https://jobicy.com/jobs/161935-senior-software-engineer-patch-engineering-vulnerability-remediation.md) Who we are At Domino, we build solutions that help the largest, highly regulated organizations adopt AI to accelerate mission-critical use cases. Our platform integrates a streamlined model and app… * ![Rackner logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2026/11/05f1f6baeea0-221.webp) Rackner Nov 13 New ### [Application Security Engineer — Secure Mission Systems](https://jobicy.com/jobs/161922-application-security-engineer-secure-mission-systems.md) Application Security Engineer — Secure Mission Systems Location: Mainly remote, with onsite work in Laurel, Maryland, typically one day approximately every six weeks for team-wide sprint planningClearance: Active final DoD… * ![TRM Labs logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/34aa038c-221.png) TRM Labs Nov 13 New ### [Global Investigator – National Security](https://jobicy.com/jobs/161913-global-investigator-national-security.md) Build a Safer World. TRM Labs provides AI-powered intelligence solutions that help public and private sector agencies investigate and disrupt crime. TRM’s platforms enable investigators to trace illicit activity, build… * ![UpGuard logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/474a12c7-221.png) UpGuard Nov 13 New ### [Staff Security Engineer (Product & Cloud)](https://jobicy.com/jobs/161789-staff-security-engineer-product-cloud.md) Who are we? At UpGuard, we are replacing manual security bottlenecks with AI-driven precision. Fresh off a US$75M Series C, we are scaling our infrastructure to process 100 billion risk… * ![TITAN logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/08/81b82aeb-221.png) TITAN Nov 13 New ### [Chief Information Security Officer (CISO), RFA](https://jobicy.com/jobs/161782-chief-information-security-officer-ciso-rfa.md) About RFA and Titan RFA is a leading IT and cybersecurity partner to financial services firms: hedge funds, private equity, asset managers, and the firms that serve them. RFA is… * ![Nebius logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2026/06/d90c0566-221.webp) Nebius Nov 13 New ### [Detection & Response Engineer](https://jobicy.com/jobs/161755-detection-response-engineer-2.md) About Nebius: Nebius is leading a new era in cloud infrastructure for the global AI economy. We are building a full-stack AI cloud platform that supports developers and enterprises from… * ![Canonical logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/b4d068a9-221-1.png) Canonical Nov 12 New ### [Linux Cryptography and Security Engineer](https://jobicy.com/jobs/161678-linux-cryptography-and-security-engineer.md) This is a unique opportunity to use your software engineering and cryptography skills to build and maintain the security foundation that enables Ubuntu and its users to operate securely and… * ![Latent logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2026/11/c872d1ae22b7-221.webp) Latent Nov 12 New ### [Security Engineer](https://jobicy.com/jobs/161597-security-engineer-7.md) About Latent Latent is the enterprise pharmacy intelligence platform, powered by a clinical agentic engine, that enables health systems to grow their pharmacy operations and serve more patients. One engine… [Browse all jobs](https://jobicy.com/jobs.md)