Principal Software Engineer

Siteimprove • Bellevue, WA

1d • $132,974 - $166,217

About The Position

Siteimprove is hiring a Principal Software Engineer for its Access team, which owns the systems used for sign-in, single sign-on, customer identity-provider federation, and authorization across the Siteimprove platform. The role focuses on designing, building, and operating identity and access services, supporting enterprise and public-sector customer SSO, helping meet FedRAMP requirements, and defining authentication for AI agents and machine clients. This is a hands-on position with substantial technical ownership and responsibility as an identity subject-matter expert across engineering.

The engineer will develop login, session, MFA, and token services; own SAML and OIDC integrations with customer identity providers; manage provisioning and user lifecycle capabilities; and evolve centralized authorization models, APIs, and caching. The role also includes defining delegated, least-privilege authentication for AI agents, MCP servers, and integrations; implementing security and compliance controls; improving reliability and observability; and providing technical leadership through design reviews, build-versus-buy decisions, and mentoring. Travel may be required, and a valid passport is required. Other duties may be assigned.

The position may involve access to systems, information, or customer environments subject to FedRAMP. Applicable roles may require federal I-9 verification and may have citizenship or residency restrictions; employment offers may depend on meeting access requirements for the relevant authorization level.

The posted base salary range is $132,974–$166,217 per year, with the specific amount determined by experience, qualifications, and location. Siteimprove describes Denmark benefits including generous time off, Danish holiday entitlements, five additional FF Days, child sick leave, bereavement leave, health insurance, company-paid mobile phone support, an internet allowance, and an employer-contribution Danica pension.

Requirements

• At least 6 years of professional software engineering experience, including at least 3 years building or operating authentication, authorization, or identity systems in production.
• Strong backend skills in C#/.NET or Java, with willingness to work in whichever language a service uses.
• Practical expertise in OAuth 2.0/2.1, OpenID Connect, and SAML 2.0, including grant types, JWT token formats, PKCE, token lifetimes and revocation, and assertion signing and encryption.
• Hands-on experience with at least one identity provider, in-house, open source, or commercial, including integrating customer identity providers for enterprise SSO.
• Experience designing authorization models and permission services that remain correct and performant at scale.
• Understanding of identity threats such as token theft and replay, session fixation, CSRF, open redirects, and IdP-initiated SSO risks, and how to mitigate them.
• Experience building distributed cloud-native services on AWS or Azure, including containers, CI/CD, and production observability.
• Uses AI tools regularly to understand code, generate tests, and deliver work more quickly.
• Ability to explain complex identity trade-offs to engineers, product managers, and auditors.
• A valid passport; travel may be required.

Nice To Haves

• Experience with FedRAMP or other government compliance programs and NIST SP 800-63 identity and federation assurance levels.
• Experience with FIPS 140-validated cryptographic modules, HSM- or KMS-backed key management, and certificate lifecycle automation.
• Experience with policy engines or fine-grained authorization systems such as OPA, Cedar, OpenFGA, or Zanzibar-style systems.
• Familiarity with the Model Context Protocol authorization specification, OAuth token exchange, or workload identity such as CIMD or IAM roles for service accounts.
• Experience with SCIM 2.0.
• Experience leading an identity-platform migration without disrupting customers.

Responsibilities

• Build and run login, session, MFA, and token services.
• Own SAML and OIDC integrations with customer identity providers, including metadata, certificate rotation, and enterprise edge cases.
• Own user lifecycle provisioning, including SCIM, just-in-time provisioning, and deprovisioning.
• Evolve centralized permissions and authorization services, models, APIs, and caching to provide fast, consistent access decisions.
• Define authentication and delegated, least-privilege access for AI agents, MCP servers, and integrations using OAuth 2.x, with consent and auditability.
• Design against account takeover and token abuse; implement FedRAMP identity controls, including FAL2, signed and encrypted assertions, and FIPS-validated cryptography.
• Work with Security and GRC on audit evidence and vulnerability remediation.
• Improve reliability and observability for critical identity services.
• Lead design reviews and build-versus-buy decisions, mentor engineers, and serve as an identity expert across engineering.
• Travel as required; a valid passport is required.
• Perform other duties as assigned.

Benefits

• Generous time off, including Danish holiday entitlements and five additional FF Days.
• Child sick leave and bereavement leave.
• Health insurance.
• Company-paid mobile phone support.
• Internet allowance.
• Danica pension with employer contributions.

What This Job Offers

• Job Type: Full-time
• Career Level: Principal
• Education Level: No Education Listed