Principal Identity and API Architect

What you'll do

• Architect and own TripleLift’s end-to-end identity platform including tenant models, SSO integrations, machine-to-machine authentication, and delegated administration
• Design and implement Auth0 tenant architecture including custom domains, enterprise connections, Actions/Rules, and token lifecycle management
• Define and enforce OAuth 2.0 and OIDC flows across the Exchange ensuring secure and consistent authentication
• Build and operate multi-tenant authorization models using OpenFGA or comparable ReBAC systems
• Own the API gateway layer including rate limiting, scoped token validation, mTLS enforcement, and consistent error semantics
• Lead publisher-side identity integrations including federated SSO, delegated self-service administration, and integration of first-party data and authenticated traffic signals
• Lead demand-side identity integrations including DSP and agency API authentication, partner onboarding flows, and identity traceability for audit and fraud detection
• Manage AWS identity and API infrastructure including IAM roles, cross-account trust, Cognito integration, Secrets Manager, KMS, and STS-based service-to-service auth
• Establish and maintain identity and API security standards including threat modeling and compliance reviews
• Serve as internal subject-matter expert on identity and API architecture advising on protocols, vendor evaluation, and regulatory considerations
• Mentor engineers on identity best practices, OAuth/OIDC protocols, and secure API design

Requirements

• 8+ years of software engineering or platform architecture experience
• At least 4 years focused on identity, IAM, or API security
• 2+ years hands-on production experience with Okta's Auth0
• Experience with tenant architecture, custom domains, and enterprise connections in Auth0
• Experience with Actions/Rules/Hooks and Auth0 Management API
• Experience with OIDC/OAuth 2.0 flows including PKCE, M2M client credentials, and device authorization
• Experience with token customization, refresh token rotation, and session management
• Production experience with OpenFGA or comparable ReBAC systems
• Deep fluency in OAuth 2.0, OpenID Connect, SAML 2.0, JWT, and JWKS
• Demonstrated AWS identity and API infrastructure experience including IAM roles, policies, cross-account trust, API Gateway, Lambda authorizers, Cognito integration, Secrets Manager, KMS, and STS
• Experience designing and operating API gateway layers at scale with Traefik, Kong, AWS API Gateway or equivalent
• Experience with publisher-side identity integrations including federated SSO, multi-tenant identity models, delegated administration, and integration with identity signals
• Experience with demand-side identity integrations including DSP and agency API authentication, partner onboarding flows, identity traceability, and buyer identity infrastructure
• Ability to model complex multi-tenant authorization hierarchies using RBAC, ABAC, or ReBAC
• Proficiency in at least one backend language (Go, Java, or Python preferred)

Tech stack

Benefits