Principal Software Engineer

Salary Range: 164114 to 205143 (Currency: USD) (Pay period: per-year-salary)

Siteimprove is the leader in agentic content intelligence. Our platform brings accessibility, analytics, SEO/AEO, and content strategy together in one system, where AI agents work alongside marketing and digital teams to produce content that is accessible and easy to find.

Every customer, user, and increasingly every AI agent that touches the Siteimprove platform goes through systems owned by the Access team: sign-in, single sign-on, federation with customer identity providers, and the authorization layer that decides who can see and do what.

We're looking for a Software Engineer with real depth in authentication, authorization, and identity provider (IdP) systems. You'll design and build the services that secure the Siteimprove platform, work with enterprise and public-sector customers' SSO setups, help us meet FedRAMP requirements, and shape how AI agents and machine clients authenticate against our APIs and MCP servers.

This is a hands-on role with a lot of technical ownership. You'll be one of the people others on the team, and across engineering, come to with identity questions.

What we will be doing

• SSO and federation: Build and run our login, session, MFA, and token services. Own SAML and OIDC integrations with customer IdPs (Okta, Entra ID, Ping, ADFS), from metadata and certificate rotation to enterprise edge cases.
• Provisioning: Own the user lifecycle across SCIM, JIT provisioning, and deprovisioning.
• Authorization platform: Evolve our centralized permissions and authorization services, including the models (RBAC, ABAC, ReBAC), APIs, and caching, so product teams get fast, consistent access decisions.
• Agent identity: Define how AI agents, MCP servers, and integrations authenticate and get delegated, least-privilege access through OAuth 2.x (token exchange, scoped short-lived tokens), with consent and auditability built in.
• Security and compliance: Design against account takeover and token abuse. Implement FedRAMP identity controls (FAL2, signed and encrypted assertions, FIPS-validated cryptography), and work with Security and GRC on audit evidence and addressing vulnerabilities.
• Reliability: Raise the bar for reliability and observability on services where an outage means nobody can log in.
• Technical leadership: Lead design reviews and build-vs-buy decisions, mentor engineers, and be the go-to identity expert across engineering.
• Travel may be required; a valid passport is required
• Perform other duties as assigned 

What we will require of you

• Engineering depth: 6+ years of professional software engineering, with at least 3 years building or running authentication, authorization, or identity systems in production.
• Backend stack: Strong backend skills in C#/.NET or Java, and a willingness to work in whichever one a given service uses.
• Protocol expertise: Deep, practical knowledge of OAuth 2.0/2.1, OpenID Connect, and SAML 2.0: grant types, token formats JWT, PKCE, token lifetimes and revocation, and assertion signing and encryption.
• IdP experience: Hands-on experience with at least one IdP, whether in-house, open source (such as Keycloak), or commercial (such as FusionAuth, Auth0, Okta, Entra ID, or Cognito), including integrating customer IdPs for enterprise SSO.
• Authorization design: Experience designing authorization models and permission services that stay correct and fast at scale.
• Security mindset: A solid grasp of identity threats (token theft and replay, session fixation, CSRF, open redirects, IdP-initiated SSO risks) and how to design against them.
• Cloud-native systems: Experience building distributed services on AWS or Azure, including containers, CI/CD, and production observability.
• AI-native delivery: You use AI tools every day to understand code, generate tests, and ship faster.
• Clear communication: You can explain a tricky identity trade-off to engineers, product managers, and auditors.
 

What we will love about you

• Experience with FedRAMP, or other government compliance programs, and with NIST SP 800-63 identity and federation assurance levels.
• Experience with FIPS 140-validated crypto modules, HSM or KMS-backed key management, and certificate lifecycle automation.
• Experience with policy engines or fine-grained authorization systems such as OPA, Cedar, OpenFGA, or other Zanzibar-style systems.
• Familiarity with the Model Context Protocol (MCP) authorization spec, OAuth token exchange, or workload identity (CIMD, IAM roles for service accounts).
• Experience with SCIM 2.0.
• Experience leading a migration between identity platforms without disrupting customers.

What you'll love about us

We’re building the next generation of AI-powered content intelligence, helping organizations unify accessibility, SEO/AEO, analytics, and content performance into one platform. If you’re energized by solving complex problems, working cross-functionally, and contributing to a product with real-world impact, we’d love to connect.

In addition, we hope you will appreciate:

At Siteimprove, we're committed to supporting your wellbeing both at work and beyond. Our U.S. benefits are designed to help you stay healthy, recharge, care for your family, and plan confidently for the future.

 

Rest and relaxation: Open Paid Time Off (OPTO) for vacation, personal illness, mental health, or caring for a family member, plus paid holidays, volunteer leave, parental leave, and our Step Back In program to support a smooth transition back to work. 

Comprehensive benefits: Medical, dental, and vision coverage, Health Savings Account (HSA), Flexible Spending Accounts (FSA), employer-paid life and disability insurance, employee assistance programs, virtual care, wellness resources, and more.

Prepare for the future: 401(k) with company matching contributions, life and AD&D insurance, and financial wellness resources to help you plan for the future