> Markdown version of [/jobs/ext/4409640-software-engineer-identity-platform](https://www.wearedevelopers.com/jobs/ext/4409640-software-engineer-identity-platform). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Software Engineer, Identity Platform

- **Company:** OpenRouter, Inc.
- **Location:** United States (Remote available)
- **Experience:** Expert
- **Salary:** $215,000.0 - $285,000.0
- **Contract:** Permanent contract
- **Skills:** Artificial Intelligence, Audit Trail, User Authentication, Software as a Service, Customer Data Management, Software Debugging, PostgreSQL, OAuth, OpenID, Role-Based Access Control, Cloud Services, Security Assertion Markup Language (SAML), SQL Databases, TypeScript, Okta, Agentic-AI, Stripe, Gsuite
- **Published:** October 21, 2026
- **Apply:** https://www.builtincolorado.com/job/software-engineer-identity-platform/11781744?handler=ApplyRedirect

## About the Role

* 5+ years building production identity, authentication or authorization systems at a SaaS, developer-platform or security company.
 * Deep fluency in identity standards: OAuth 2.x (PKCE, token exchange, dynamic client registration), OIDC, SAML, SCIM and JWTs, and the ways they break in practice.
 * Experience designing authorization models (RBAC, ABAC or ReBAC) for multi-tenant B2B products, including migrating a live system from ad-hoc checks to a unified model.
 * Hands-on experience integrating enterprise identity providers (Okta, Entra ID, Google Workspace) and an auth platform (Clerk, Auth0, WorkOS or similar).
 * Strong TypeScript and SQL. Comfortable with Postgres and building low-latency, cache-heavy services on a critical request path.
 * A security mindset. You think in threat models, design for least privilege and can explain your decisions to an enterprise security reviewer.
 * You work well across teams. You'll partner daily with Trust & Safety, Money, Product, Sales and CS, and turn messy enterprise asks into clean systems.
 * High agency and AI-forward. You use coding agents daily and like automating away manual security and onboarding work.

Nice to Haves

 * You've shipped enterprise SSO and SCIM that passed real customer security reviews.
 * You've built workload identity federation or secretless auth for CI and cloud workloads.
 * You've built OAuth, consent and delegation for AI agents or MCP clients acting on behalf of users.
 * Experience with identity verification, KYC or fraud and risk systems (e.g. Stripe Identity, Persona, Sift).
 * Experience with policy engines or fine-grained authorization (e.g. OpenFGA, Cedar, OPA, Zanzibar-style systems).
 * You've helped a company achieve SOC 2, ISO 27001 or similar compliance.
 * You're an existing OpenRouter user, or have built projects in AI tooling.

## Description

* Make enterprise provisioning just work. SCIM user and group provisioning, group-to-role mapping, domain verification and self-serve SSO that works first try with Okta, Entra ID, Google Workspace and the long tail of identity providers. Partner platforms can provision accounts and keys for their own customers programmatically. An IT admin should be able to onboard thousands of seats without filing a ticket.
 * Define the core identity model. Users, organizations, workspaces, memberships, apps and guardrails, and how they compose. Clean boundaries, clear ownership semantics and a data model that supports the next five years of enterprise features without a rewrite.
 * Protect users and their data. Identity fraud detection, KYC and verification flows, step-up checks on sensitive actions, account-takeover defenses and abuse signals that stop bad actors without adding friction for good ones. Least-privilege access to customer data across every OpenRouter surface.
 * Treat auditability and correctness as features. The system ensures every credential has a provenance, every access decision is explainable and every privileged change lands in an audit log. Auth stays fast and highly available on the hot path of every inference request, with clear, standards-based failure modes developers can debug on their own. An access grant nobody can explain is a bug.
 * Work cross-functionally. Partner closely with the Trust & Safety team on fraud and abuse, with the Money team on payment-linked verification and risk, with Product on dashboard and onboarding experiences, and with Sales and CS on enterprise security reviews and SSO rollouts.