Staff Engineer – Machine & Workload Identity

We are looking for an experienced Staff Engineer specialising in Machine and Workload Identity to help design and build secure authentication systems operating at enterprise scale.

This is a highly technical, hands-on engineering role focused on enabling secure service-to-service authentication across applications, APIs, cloud platforms and distributed workloads.

You will work at the intersection of cyber security, identity, cloud and software engineering, helping shape how machine identities are provisioned, authenticated, rotated and governed across a complex enterprise environment.

You will be expected to design, build and ship production systems.

What You’ll Do

• Design and build machine and workload identity infrastructure at enterprise scale.
• Develop secure service-to-service authentication solutions.
• Build automated identity lifecycle processes covering provisioning, rotation and revocation.
• Integrate authentication across cloud platforms, APIs, application environments and service meshes.
• Develop production-grade tooling and prototypes using Python or Go.
• Solve complex authentication and identity issues across distributed environments.
• Make technical and architectural decisions within your domain.
• Review code and architecture and mentor other engineers.
• Help develop internal engineering standards around machine identity and authentication.
• Evaluate and introduce emerging identity technologies where they provide practical value.

What We’re Looking For

• Machine identity or workload identity infrastructure.
• OAuth, OIDC and application authentication.
• Cloud IAM across AWS, Azure or GCP.
• API gateway authentication and integration.
• Identity provisioning, rotation and revocation.
• JWTs, cryptographic signing and identity protocols.
• Building and debugging authentication within distributed systems.
• Production software development using Python or Go.
• Designing secure authentication architecture across multiple identity layers.

Experience with one or more of the following would be particularly valuable:

• SPIFFE / SPIRE
• HashiCorp Vault
• Service mesh authentication
• API gateway security
• Workload identity federation
• Attested machine identities
• Zero-trust architecture
• Open-source identity projects
• Large-scale identity lifecycle automation