> Markdown version of [/jobs/ext/2809060-principal-platform-engineer-agentic-ai-identity-and-access-management](https://www.wearedevelopers.com/jobs/ext/2809060-principal-platform-engineer-agentic-ai-identity-and-access-management). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Principal Platform Engineer Agentic AI Identity and Access Management - **Company:** IFS - **Location:** UK - **Contract:** Permanent contract - **Skills:** Active Directory, Application Programming Interfaces (APIs), User Authentication, Distributed Systems, Identity and Access Management, Lightweight Directory Access Protocols (LDAP), PostgreSQL, Cisco Nexus Switches, OAuth, OpenID, Role-Based Access Control, Openid Connect, Security Assertion Markup Language (SAML), Secure Coding, Data Streaming, Okta, Backend, Containerization, Kubernetes, Low Latency, Apache Kafka, Virtual Agents - **Published:** September 9, 2026 - **Apply:** https://www.totaljobs.com/job/principal-platform-engineer/ifs-uk-job107957779 ## About the Role Authorisation (Must Have) * Architecting and engineering fine-grained authorisation systems at production scale, in distributed, multi-tenant environments * Hands-on production experience with a relationship-based / policy-based authorisation engine, ideally SpiceDB (or comparable Zanzibar-inspired systems such as OpenFGA, Ory Keto, or equivalent) * Deep, practical knowledge of authorisation models: relationship-based access control (ReBAC), role-based (RBAC), and attribute-based (ABAC), and knowing when to apply each * Experience designing authorisation schemas and permission models, and reasoning about correctness, latency, and consistency at scale * Familiarity with policy-as-code approaches and tooling (OPA / Rego, Cedar, or equivalent) * Understanding of the operational side: running the authorisation engine in production, backed by PostgreSQL, with observability and traceability of authorisation decisions Authentication (Must Have) * Architecting and engineering enterprise-scale AuthN solutions, demonstrated at production scale * Hands-on production experience with Curity and/or Keycloak: configuration, customisation, operations, and integration * Deep, practical knowledge of OAuth 2.0, OpenID Connect (OIDC), SAML 2.0, and token-based authentication patterns (JWT, opaque tokens, token introspection) * Experience with enterprise identity federation, SSO, and directory integration (LDAP, Active Directory) * Strong hands-on engineering capability across the NGA stack, or the ability to get there fast: + Backend: Go + Messaging / Streaming: Apache Kafka / RedPanda + Data: PostgreSQL * Comfortable operating in a cloud-native environment: Kubernetes (AKS), containers, GitOps, Infrastructure as Code * Event-driven and distributed systems architecture * Secure coding practices and security-by-design principles ## Description As Principal Platform Engineer - Identity & Access Management, you will be the technical authority on authorisation (AuthZ) and authentication (AuthN) across the Kairos and Nexus platforms. You will architect, engineer, and operate enterprise-scale identity and access solutions that secure the IFS platform while remaining frictionless for the developers and end-users who rely on them., This is one of two Principal Platform Engineers being hired into the Identity & Access Management domain, with a strong emphasis on unifying authorisation across IFS hosting environments. The authorisation problem is complex and high-stakes: it must work consistently across Nexus, F1, and LEC, it must scale to enterprise, multi-tenant workloads, and it is currently a blocker for NGA (Kairos) adoption. You will work directly with the team building this today (the Authorisation subdomain under Udayanga Silva) and own the technical outcome. This is a hands-on engineering role with significant architectural scope. You will design and implement IAM patterns that are adopted as standards across IFS, and you will work closely with platform, product, and security teams to ensure identity and access are enablers, not bottlenecks. * Architect and engineer the unified, enterprise-scale authorisation platform across Nexus, F1, and LEC, built on SpiceDB * Design and implement fine-grained authorisation models: relationship-based access control (ReBAC / Zanzibar-inspired), alongside RBAC and ABAC where appropriate * Model authorisation schemas, relationships, and permission checks that are correct, performant, and maintainable at scale * Own the operation of the authorisation engine: SpiceDB on PostgreSQL, including the migration to cloud-native Postgres (CNPG) and blue-green deployment support * Build the authorisation APIs and SDKs that product teams consume, making correct access control the path of least resistance * Architect and engineer enterprise-scale AuthN solutions, and own the implementation, configuration, and operation of identity provider infrastructure, specifically Curity and/or Keycloak * Implement and enforce OAuth 2.0, OpenID Connect (OIDC), and SAML patterns at scale, including token lifecycle management and claims-based authorisation * Define IAM patterns, standards, and golden paths for product teams to implement securely and consistently * Integrate identity and access services with the Internal Developer Platform (IDP) to enable self-service authentication and authorisation configuration * Provide subject-matter expertise on identity and access security to product teams, architects, and security stakeholders * Maintain platform identity and access service reliability, performance, and security posture * Contribute to the broader platform engineering roadmap with an identity-and-access-first perspective ## Related Videos - [Keeping applications secure by evolving OAuth 2.0 and OpenID Connect](https://www.wearedevelopers.com/videos/100152-keeping-applications-secure-by-evolving-oauth-2-0-and-openid-connect) - [Delay the AI Overlords: How OAuth and OpenFGA Can Keep Your AI Agents from Going Rogue](https://www.wearedevelopers.com/videos/1637-delay-the-ai-overlords-how-oauth-and-openfga-can-keep-your-ai-agents-from-going-rogue) - [Get started with securing your cloud-native Java microservices applications](https://www.wearedevelopers.com/videos/123-get-started-with-securing-your-cloud-native-java-microservices-applications) - [Delegating the chores of authenticating users to Keycloak](https://www.wearedevelopers.com/videos/1558-delegating-the-chores-of-authenticating-users-to-keycloak) - [Un-complicate authorization maintenance](https://www.wearedevelopers.com/videos/889-un-complicate-authorization-maintenance) - [Advanced Cypress: custom assertions and tasks](https://www.wearedevelopers.com/videos/790-advanced-cypress-custom-assertions-and-tasks) ## Related Articles - [How We Built a Worry-Free System That Runs for 10+ Years – And What We’d Do Again](https://www.wearedevelopers.com/magazine/751-how-we-built-a-worry-free-system-that-runs-for-10-years-and-what-we-d-do-again) - [Graph and AI Trends 2026: Why Is AI Running but Not Yet Delivering?](https://www.wearedevelopers.com/magazine/680-graph-and-ai-trends-2026-why-is-ai-running-but-not-yet-delivering) - [Everything a Developer Needs to Know About MCP with Neo4j](https://www.wearedevelopers.com/magazine/604-everything-a-developer-needs-to-know-about-mcp-with-neo4j) - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [The Best X (Twitter) Accounts for Developers](https://www.wearedevelopers.com/magazine/294-the-best-x-twitter-accounts-for-developers) - [Dev Digest 120 - Apple and peers](https://www.wearedevelopers.com/magazine/455-dev-digest-120-apple-and-peers)