Principal Identity and API Architect

What you'll do

• Architect and own TripleLift’s end-to-end identity platform including tenant models, SSO integrations, machine-to-machine authentication, and delegated administration
• Design and implement Auth0 tenant architecture including custom domains, enterprise connections, Actions/Rules, and token lifecycle management
• Define and enforce OAuth 2.0 and OIDC flows across the Exchange ensuring secure authentication
• Build and operate multi-tenant authorization models using OpenFGA or comparable ReBAC systems
• Own the API gateway layer including rate limiting, scoped token validation, mTLS enforcement, and consistent error semantics
• Lead publisher-side identity integrations including federated SSO, delegated self-service administration, and integration of first-party data
• Lead demand-side identity integrations including DSP and agency API authentication, partner onboarding, and identity traceability
• Manage AWS identity and API infrastructure including IAM roles, Cognito, Secrets Manager, KMS, and STS-based service-to-service auth
• Establish and maintain identity and API security standards, conduct threat modeling, review integrations for compliance, and respond to security incidents
• Serve as internal subject-matter expert on identity and API architecture advising on protocol selection, vendor evaluation, and regulatory considerations
• Mentor engineers on identity best practices, OAuth/OIDC protocol nuances, and secure API design patterns

Requirements

• 8+ years of software engineering or platform architecture experience, with at least 4 years focused on identity, IAM, or API security
• 2+ years of hands-on production experience with Okta's Auth0
• Experience with tenant architecture, custom domains, and enterprise connections in Auth0
• Experience with Actions/Rules/Hooks and the Auth0 Management API
• Experience with OIDC/OAuth 2.0 flows including PKCE, M2M client credentials, and device authorization
• Experience with token customization, refresh token rotation, and session management
• Production experience with OpenFGA or comparable ReBAC systems (e.g., Zanzibar-derived implementations, Ory Keto, SpiceDB)
• Deep fluency in OAuth 2.0, OpenID Connect, SAML 2.0, JWT, and JWKS
• Demonstrated AWS identity and API infrastructure experience including IAM roles, policies, cross-account trust, API Gateway, Lambda authorizers, Cognito, Secrets Manager, KMS, STS
• Experience designing and operating API gateway layers at scale with Traefik, Kong, AWS API Gateway or equivalent
• Experience with publisher-side identity integrations including federated SSO (SAML 2.0, OIDC), multi-tenant identity models, delegated administration, and integration with publisher identity signals
• Experience with demand-side identity integrations including DSP and agency API authentication, partner onboarding flows, identity traceability, and buyer identity infrastructure
• Ability to model complex multi-tenant authorization hierarchies using RBAC, ABAC, or ReBAC
• Proficiency in at least one backend language (Go, Java, or Python preferred)

Tech stack

Benefits