Principal Platform Engineer - Identity Platform (AuthN/AuthZ)

About the role

IFS is hiring two Principal Platform Engineers to build the shared authentication and authorisation capabilities used by its product engineering teams. The role unifies a fragmented authorisation landscape into one model across three hosting environments: the cloud-native platform, the legacy hosting platform and the lifecycle cloud. It is a hands-on position with substantial technical ownership, working in identity and access.

Key responsibilities

• Design and build platform services, APIs and automation, and own them in production.
• Establish patterns that product engineering teams can adopt, with secure authentication and authorisation available through documented, automated, self-service workflows.
• Write and review infrastructure and automation code, build platform integrations and contribute to tooling and services, including those written in Go.
• Work on the current stack of SpiceDB backed by PostgreSQL for authorisation and Curity for authentication, with Keycloak estates migrating onto it.

Required profile

• Hands-on platform engineer who builds through code and automates by default, with substantial experience building or extending platform capabilities through code and automation.
• Background in platform engineering, infrastructure, SRE, identity engineering or systems integration; a software development background is particularly valuable but not required.
• Demonstrable experience designing, building and shipping production AI applications; candidates who only use AI tools to assist coding will not meet the requirements.
• Specialist experience in identity and access is particularly welcome.

Required skills

• Infrastructure code, automation, delivery pipelines, integrations or platform tooling you have personally built and maintained.
• Containerised services on Kubernetes in a software delivery environment.
• Authorisation: role-based, attribute-based and relationship-based models, permission checks, tenant isolation, and familiarity with fine-grained authorisation engines or policy-as-code.
• Authentication: OAuth 2.0, OpenID Connect, token lifecycle, federation, SSO and external identity-provider integration.
• Cloud infrastructure, Kubernetes, containers, GitOps and Infrastructure as Code.
• Reliability approach including observability, performance testing, safe rollouts, rollback, backup and recovery.