Senior Software Engineer 1 (Identity & Trust Infrastructure) - Costa Rica [Opening 207]

SimSpace Corporation

16h

About The Position

We are looking for a Senior Software Engineer to build the identity and trust infrastructure that brings SimSpace's internet simulation platform to life for the humans and automated systems operating within it. This role owns interconnected systems: a unified persona registration API that provisions fully realized digital identities across both in-range Active Directory environments and simulated internet services; a Range Domain Controller management service that configures AD domains, users, and group policy on top of deployed range infrastructure; and a PKI and certificate authority stack that ensures in-range clients trust the simulated internet at the TLS layer. This is a security-infrastructure role with significant API design responsibility, the right candidate understands identity systems deeply, can build robust APIs that handle partial failure gracefully, and knows how to stand up and operate a home-grown certificate authority. The team is responsible for: A unified persona registration API: the single interface through which user emulation and scenario orchestration services provision fully realized range personas, creating AD accounts, configuring group memberships and privilege levels, and registering accounts across all configured simulated internet services in a single, idempotent operation A Range Domain Controller management service: the API layer that configures Active Directory domains, organizational units, users, and group policy on the DC infrastructure deployed by the range orchestration team, this team owns everything above the baseline VM configuration A PKI and certificate authority infrastructure: root CAs, intermediate CAs, certificate issuance pipelines, and the mechanisms by which in-range clients are configured to trust certificates issued for simulated internet domains The GreySpace user API: account lifecycle management across the heterogeneous set of simulated internet services, including web platforms, FTP servers, SSH services, and mail infrastructure.

Requirements

• Strong bilingual proficiency in English and Spanish skills required across written, virtual, and in-person interactions
• Deep understanding of Active Directory: user and group provisioning, organizational unit design, Group Policy, Kerberos authentication, and domain and subdomain configuration
• Experience automating AD configuration programmatically and building robust APIs on top of AD operations that handle the realities of a stateful, sometimes-slow directory service
• Knowledge of AWS, GCP, and/or Azure identity management
• Solid PKI knowledge: you understand the CA hierarchy model, certificate lifecycle management, CSR signing workflows, and how to configure client trust stores on both Windows and Linux
• Strong REST API design instincts, particularly around idempotency, partial failure handling, and eventual consistency across heterogeneous backends, this API will be called by automated orchestration systems that cannot tolerate silent failures
• Familiarity with enterprise identity providers and SSO systems as a consumer and integrator, the platform uses an existing SSO layer and this role needs to federate correctly with it without owning it
• Experience with certificate management at operational scale, issuing certificates programmatically, managing expiration, and distributing trust anchors across a fleet

Nice To Haves

• Familiarity with email authentication (SPF, DKIM, DMARC) is a plus, the email delivery model for the platform intersects with the domain and identity configuration this role owns
• Experience in cybersecurity, red team infrastructure, or environments where identity and trust infrastructure is itself a target or a tool is a strong plus

Responsibilities

• Design and build the unified persona registration API — the interface that accepts a persona definition and fans out to provision an account in real and simulated cloud services, configure group memberships and OUs, and create accounts on all relevant simulated internet services, handling partial failures idempotently and providing a consistent status model to callers
• Build and maintain the Range Domain Controller management service: the API layer that drives AD configuration, creating users, assigning group memberships, configuring OUs and domain policies, and managing subdomain configuration for simulated organizations
• Design and operate the PKI infrastructure: stand up a root CA and intermediate CA hierarchy, build certificate issuance pipelines that generate and sign certificates at domain provisioning time, and own the mechanism by which in-range clients on both Windows and Linux are configured to trust the platform CA chain
• Own the GreySpace user API: account creation, deletion, elevation, and demotion across the full service catalog, ensuring consistency between in-range AD identity and internet-facing service accounts for each persona
• Define and enforce the data model for range personas across all identity backends, AD schema, SSO federation, and per-service account state, and own the eventual consistency and reconciliation model when backends diverge
• Collaborate with the user emulation team to ensure the persona registration API meets their orchestration requirements and supports the full range of persona complexity their scenarios require
• Participate in design reviews and contribute to the broader platform architecture, particularly on topics of trust, authentication, and the security model for the internet simulation platform

Benefits

• Base monthly pay range: 1,500,000 CRC - 2,500,000 CRC
• Opportunity for annual bonuses tied to company performance and individual contributions
• Private medical, dental, vision, and life benefits
• Access to company-paid counseling, coaching, and resources for you and your family through Spring Health
• Paid leave plans to support you and your loved ones during life’s most important moments
• Equity stock options at hire, with annual performance-based grants
• Access a LinkedIn Learning membership to prioritize your personal and professional development
• Monthly reimbursements for meaningful connections with teammates through our SocialSpace Community

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed