Principal Software Engineer

Siteimprove is the leader in agentic content intelligence. Our platform brings accessibility, analytics, SEO/AEO, and content strategy together in one system, where AI agents work alongside marketing and digital teams to produce content that is accessible and easy to find. Every customer, user, and increasingly every AI agent that touches the Siteimprove platform goes through systems owned by the Access team: sign-in, single sign-on, federation with customer identity providers, and the authorization layer that decides who can see and do what.

We're looking for a Software Engineer with real depth in authentication, authorization, and identity provider (IdP) systems. You'll design and build the services that secure the Siteimprove platform, work with enterprise and public-sector customers' SSO setups, help us meet FedRAMP requirements, and shape how AI agents and machine clients authenticate against our APIs and MCP servers. This is a hands-on role with a lot of technical ownership.

You'll be one of the people others on the team, and across engineering, come to with identity questions.

• SSO and federation: Build and run our login, session, MFA, and token services. Own SAML and OIDC integrations with customer IdPs (Okta, Entra , Ping, ADFS), from metadata and certificate rotation to enterprise edge cases.
• Provisioning: Own the user lifecycle across SCIM, JIT provisioning, and deprovisioning.
• Authorization platform: Evolve our centralized permissions and authorization services, including the models (RBAC, ABAC, ReBAC), APIs, and caching, so product teams get fast, consistent access decisions.
• Agent identity: Define how AI agents, MCP servers, and integrations authenticate and get delegated, least-privilege access through OAuth 2.x (token exchange, scoped short-lived tokens), with consent and auditability built in.
• Security and compliance: Design against account takeover and token abuse. Implement FedRAMP identity controls (FAL2, signed and encrypted assertions, FIPS-validated cryptography), and work with Security and GRC on audit evidence and addressing vulnerabilities.
• Reliability: Raise the bar for reliability and observability on services where an outage means nobody can log in.
• Technical leadership: Lead design reviews and build-vs-buy decisions, mentor engineers, and be the go-to identity expert across engineering.
• Travel may be required; a valid passport is required
• Perform other duties as assigned

• Engineering depth: 6+ years of professional software engineering, with at least 3 years building or running authentication, authorization, or identity systems in production.
• Backend stack: Strong backend skills in C#/.NET or Java, and a willingness to work in whichever one a given service uses.
• Protocol expertise: Deep, practical knowledge of OAuth 2.0/2.1, OpenID Connect, and SAML 2.0: grant types, token formats JWT, PKCE, token lifetimes and revocation, and assertion signing and encryption.
• IdP experience: Hands-on experience with at least one IdP, whether in-house, open source (such as Keycloak), or commercial (such as Fusion Auth, Auth0, Okta, Entra , or Cognito), including integrating customer IdPs for enterprise SSO.
• Authorization design: Experience designing authorization models and permission services that stay correct and fast at scale.
• Security mindset: A solid grasp of identity threats (token theft and replay, session fixation, CSRF, open redirects, IdP-initiated SSO risks) and how to design against them.
• Cloud-native systems: Experience building distributed services on AWS or Azure, including containers, CI/CD, and production observability.
• AI-native delivery: You use AI tools every day to understand code, generate tests, and ship faster.
• Clear…