Principal Platform Engineer | Agentic AI | Identity and Access Management

Principal Platform Engineer || Agentic AI || Identity and Access Management

• Full-time

At IFS, we're building the next generation of AI-native enterprise software, transforming how some of the world's largest organisations manage assets, operations and critical services.

This is an opportunity to work at the forefront of modern AI engineering, building intelligent products that combine Large Language Models (LLMs), agentic AI and cloud-native technologies to solve complex, real-world business challenges at enterprise scale.

We're looking for engineers who are passionate about building production AI systems and excited by the opportunity to shape the future of enterprise software.

Please note that this role requires demonstrable, hands‑on experience designing, building and shipping production AI applications.

Candidates whose AI experience is limited to using tools such as ChatGPT, Claude, Cursor or Git Hub Copilot to assist software development, without demonstrable experience building AI‑powered products or systems, will not meet the requirements for this role.

IFS is a billion‑dollar revenue company with 7000+ employees on all continents. We deliver award‑winning enterprise software solutions through the use of embedded digital innovation and a single cloud‑based platform to help businesses be their best when it really matters–at the Moment of Service™.

At IFS, we're flexible, we're innovative, and we're focused not only on how we can engage with our customers, but on how we can make a real change and have a worldwide impact. We help solve some of society's greatest challenges, fostering a better future through our agility, collaboration, and trust.

We celebrate diversity and accept that there are so many different perspectives in this world. As a truly international company serving people from around the globe, we realize that our success is tantamount to the respect we have for those different points of view.

By joining our team, you will have the opportunity to be part of a global, diverse environment; you will be joining a winning team with a commitment to sustainability; and a company where we get things done so that you can make a positive impact on the world.

We're looking for innovative and original thinkers to work in an environment where you can #Make Your Moment  so that we can help others make theirs.

If you want to change the status quo, we'll help you make your moment. Join Team Purple. Join IFS.

As Principal Platform Engineer - Identity & Access Management
, you will be the technical authority on authorisation (AuthZ) and authentication (AuthN) across the Kairos and Nexus platforms. You will architect, engineer, and operate enterprise‑scale identity and access solutions that secure the IFS platform while remaining frictionless for the developers and end‑users who rely on them.

This is one of two Principal Platform Engineers being hired into the Identity & Access Management domain, with a strong emphasis on unifying authorisation across IFS hosting environments. The authorisation problem is complex and high‑stakes: it must work consistently across Nexus, F1, and LEC, it must scale to enterprise, multi‑tenant workloads, and it is currently a blocker for NGA (Kairos) adoption.

You will work directly with the team building this today (the Authorisation subdomain under Udayanga Silva) and own the technical outcome.

This is a hands‑on engineering role with significant architectural scope. You will design and implement IAM patterns that are adopted as standards across IFS, and you will work closely with platform, product, and security teams to ensure identity and access are enablers, not bottlenecks.

• Architect and engineer the unified, enterprise‑scale authorisation platform across Nexus, F1, and LEC, built on SpiceDB
• Design and implement fine-grained authorisation models: relationship‑based access control (ReBAC / Zanzibar‑inspired), alongside RBAC and ABAC where appropriate
• Model authorisation schemas, relationships, and permission checks that are correct, performant, and maintainable at scale
• Own the operation of the authorisation engine:
  SpiceDB on PostgreSQL, including the migration to…