Principal Software Engineer

Siteimprove • Bellevue, WA

4d • $132,974 - $166,217

About The Position

Siteimprove is hiring a Principal Software Engineer for its Access team, which owns the systems used for sign-in, single sign-on, federation with customer identity providers, and authorization across the Siteimprove platform. This hands-on role has substantial technical ownership and calls for deep experience in authentication, authorization, and identity provider systems. The engineer will design and build services that secure the platform, support enterprise and public-sector customers' SSO configurations, contribute to FedRAMP requirements, and define how AI agents and machine clients authenticate to APIs and MCP servers.

The role includes building and operating login, session, MFA, and token services; managing SAML and OIDC integrations with customer identity providers; and owning user lifecycle provisioning through SCIM, JIT provisioning, and deprovisioning. It also involves evolving centralized permissions and authorization services, designing authentication and delegated access for AI agents and integrations, and strengthening security, compliance, reliability, and observability. The Principal Engineer will lead design reviews and build-versus-buy decisions, mentor engineers, and serve as an identity subject-matter expert across engineering. Travel may be required, and a valid passport is required. Other duties may be assigned.

Requirements

• At least 6 years of professional software engineering experience, including at least 3 years building or operating production authentication, authorization, or identity systems.
• Strong backend skills in C#/.NET or Java, and willingness to work with whichever language a service uses.
• Deep practical knowledge of OAuth 2.0/2.1, OpenID Connect, and SAML 2.0, including grant types, JWT token formats, PKCE, token lifetimes and revocation, and assertion signing and encryption.
• Hands-on experience with at least one identity provider, whether in-house, open source, or commercial, including enterprise customer IdP integrations for SSO.
• Experience designing authorization models and permission services that remain correct and performant at scale.
• Solid understanding of identity threats, including token theft and replay, session fixation, CSRF, open redirects, and IdP-initiated SSO risks, and how to mitigate them.
• Experience building distributed cloud-native services on AWS or Azure, including containers, CI/CD, and production observability.
• Use AI tools regularly to understand code, generate tests, and deliver work faster.
• Ability to explain complex identity trade-offs to engineers, product managers, and auditors.
• Valid passport; travel may be required.

Nice To Haves

• Experience with FedRAMP or other government compliance programs and NIST SP 800-63 identity and federation assurance levels.
• Experience with FIPS 140-validated cryptographic modules, HSM- or KMS-backed key management, and certificate lifecycle automation.
• Experience with policy engines or fine-grained authorization systems such as OPA, Cedar, OpenFGA, or Zanzibar-style systems.
• Familiarity with the Model Context Protocol authorization specification, OAuth token exchange, or workload identity such as CIMD or IAM roles for service accounts.
• Experience with SCIM 2.0.
• Experience leading a migration between identity platforms without disrupting customers.

Responsibilities

• Build and operate login, session, multi-factor authentication, and token services.
• Own SAML and OIDC integrations with customer identity providers, including metadata, certificate rotation, and enterprise edge cases.
• Manage user lifecycle provisioning and deprovisioning through SCIM and just-in-time provisioning.
• Evolve centralized permissions and authorization services, including authorization models, APIs, and caching.
• Define authentication and delegated, least-privilege access for AI agents, MCP servers, and integrations using OAuth 2.x, with consent and auditability.
• Design against account takeover and token abuse; implement FedRAMP identity controls, including FAL2, signed and encrypted assertions, and FIPS-validated cryptography.
• Work with Security and GRC on audit evidence and vulnerability remediation.
• Improve reliability and observability of services that support user login.
• Lead design reviews and build-versus-buy decisions, mentor engineers, and provide identity expertise across engineering.
• Perform other duties as assigned.
• Travel may be required; maintain a valid passport.

Benefits

• Generous time off, including Danish holiday entitlements and five additional FF Days.
• Child sick leave and bereavement leave.
• Health insurance.
• Company-paid mobile phone support.
• Internet allowance.
• Danica pension with employer contributions.

What This Job Offers

• Job Type: Full-time
• Career Level: Principal
• Education Level: No Education Listed