Software Engineer 5 - Ads Authorization Platform
About The Position
Netflix is hiring a Software Engineer 5 for the Ads Authorization Platform. The Ads Platform Foundations team builds core platforms, frameworks, and shared services that help teams across the Ads organization work consistently and efficiently. Its work includes access control across domains and foundational systems such as Public API, GenAI foundations, and the Ads Entity Service. This role will help establish a centralized authorization model and platform. The engineer will contribute to build-versus-buy evaluation, policy-model design, decision-engine architecture, integrations, reference implementations, testing, and migration from scattered authorization checks to a common policy engine.
Requirements
- 5–8+ years of backend or software engineering experience shipping production systems.
- Hands-on experience working on or building an authorization system, with solid RBAC fundamentals and practical understanding of roles, permissions, role hierarchies, and resource-level versus organization-level scoping.
- Conceptual grounding in authorization fundamentals and ability to reason about tradeoffs among RBAC, ABAC, and ReBAC approaches.
- Exposure to evaluating or integrating a policy engine or framework, or experience with an equivalent in-house system.
- Strong systems design skills, including low-latency decision services and caching and consistency-versus-performance tradeoffs.
- Proficiency in one backend stack: Java, Kotlin, Go, Node, or Python.
Nice To Haves
- Experience with policy-as-code languages such as Rego, Cedar, or Polar, or Zanzibar-paper-inspired systems.
- Participation in a build-versus-buy or vendor RFP process.
- Familiarity with authentication (OAuth/OIDC) and the typical boundary between authentication and authorization.
- Experience with large-scale multi-tenant SaaS platforms.
- Experience building for external organizations in a B2B context, not only internal access controls.
- Open-source contributions to authorization projects such as OpenFGA, Cerbos, or Casbin.
Responsibilities
- Co-drive evaluation of centralized authorization options, including vendor bake-offs against an in-house solution, considering latency, flexibility, operational cost, and vendor lock-in.
- Help design the authorization policy model, including roles, permissions, relations, role scope and hierarchy, resource ownership and sharing, and multi-tenancy.
- Partner on decision-engine architecture, including low-latency checks, caching, consistency tradeoffs, and policy auditing and versioning.
- Work with platform, security, and IAM teams to integrate authorization checks into services at synchronous and asynchronous enforcement points.
- Build reference implementations, SDKs, and middleware to support adoption of the centralized authorization model.
- Contribute to policy unit tests and authorization test suites, as well as the migration plan from scattered checks to a single policy engine.
Benefits
- Health plans
- Mental health support
- 401(k) retirement plan with employer match
- Stock option program
- Disability programs
- Health savings and flexible spending accounts
- Family-forming benefits
- Life and serious injury benefits
- Paid leave of absence programs
- Full-time hourly employees accrue 35 days annually for vacation, holidays, and sick paid time off
- Full-time salaried employees are immediately entitled to flexible time off
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Senior
Education Level
No Education Listed
