Staff Software Engineer - IAM (Platform Engineering)

Qcells North America is seeking a Staff Software Engineer to lead the architecture, design, and implementation of Identity and Access Management services for its multi-tenant SaaS platform. The role owns authentication, authorization, and identity services; develops APIs, SDKs, and tooling; partners with security and compliance teams; drives incident response; and mentors engineers.

Responsibilities:

• Architect, design, and implement IAM platform services enabling authentication and authorization across the SaaS product
• Define and own IAM architecture: identity boundaries, trust models, access patterns, token lifecycles
• Build scalable services supporting OAuth 2.0, OIDC, SAML, and SCIM
• Develop APIs, SDKs, and tooling for safe, intuitive consumption by product teams
• Apply least‑privilege and Zero Trust principles across users, services, and infrastructure
• Lead technical decision‑making with clear tradeoffs across security, usability, and performance
• Partner with Security and Compliance for SOC 2, ISO 27001, and NIST alignment
• Drive incident response and root‑cause analysis for identity‑related issues
• Mentor engineers and elevate IAM engineering practices and platform reliability

Requirements:

• 10+ years of software engineering experience, including 4+ years building IAM systems
• Deep expertise with SAML, OAuth 2.0, OIDC, SCIM
• Bachelor's or Master's degree in Computer Science, Engineering, or related field (or equivalent experience)
• Experience integrating with IAM platforms (Entra ID, Okta, Ping Identity, ForgeRock) as an engineer, not an administrator
• Expert‑level proficiency in one or more backend languages (e.g., Java, C#) and in building production services (testing, observability, performance)
• Experience with cloud platforms (Azure, AWS, or GCP) and Infrastructure as Code (Terraform, ARM, CloudFormation)
• Familiarity with Zero Trust, least privilege, CI/CD, DevSecOps
• Experience with distributed systems and containers (Docker, Kubernetes)
• Ability to travel up to 10%
• This role is remote, however, the candidate(s) will be expected to relocate at their own expense to our onsite Houston location by *Q1 in 2027*
• Experience building IAM capabilities for multi‑tenant SaaS (tenant isolation, per‑tenant config, scale)
• Background in platform engineering, identity platforms, or security infrastructure engineering
• Understanding of compliance frameworks (SOC 2, ISO 27001, NIST)