> Markdown version of [/jobs/ext/571091-staff-software-engineer-i-internal-access-management](https://www.wearedevelopers.com/jobs/ext/571091-staff-software-engineer-i-internal-access-management). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Staff Software Engineer I - Internal Access Management - **Company:** Confluent, Inc - **Location:** Trenton, NJ, United States (Remote available) - **Experience:** Experienced - **Salary:** $225,100.0 - **Contract:** Permanent contract - **Skills:** Amazon Web Services, Systems Engineering, User Authentication, Microsoft Azure, Cloud Computing, Cloud Computing Security, Distributed Systems, Identity and Access Management, OAuth, OpenID, Zero Trust Network Access, Google Cloud, Istio, Multi-Cloud, Kubernetes, Apache Kafka, Confluent - **Published:** June 12, 2026 - **Apply:** https://dejobs.org/x/x/825678CB7D744AA98DC6EC51591D6ECC/job/ ## About the Role * 10+ years of engineering experience, with 4+ years in security, IAM, or distributed systems. * Deep expertise in Kubernetes , workload identity , cloud IAM (AWS, GCP, Azure), and zero-trust architectures . * Strong understanding of authentication technologies: IAM , OAuth2 , OIDC , policy engines , and modern zero-trust principles. * Proven track record leading multi-team technical initiatives at a Staff or Senior Staff level. * Strong knowledge of distributed systems, cloud infrastructure, container orchestration, and service mesh. * Excellent communication and stakeholder-influence skills across engineering and security domains. What Gives You an Edge: * Experience leading cross-org security platform architecture initiatives. * Background in building developer-focused authentication and authorization platforms. Ready to build what's next? Let's get in motion. ## Description We are seeking a Staff Software Engineer to lead the technical vision, architecture, and execution for Internal Access Management at Confluent. This role is central to our trusted compute environment and requires deep expertise in distributed systems, cloud security, authentication, and policy-driven authorization frameworks. As the domain owner, you will define how Confluent enforces least privilege, manages workload identity, governs access boundaries, and ensures secure, auditable authorization across all engineering systems. You will partner with Security, Product, and Engineering to establish a cohesive end-to-end access posture. What You Will Do: * Define and drive the long-term architecture and roadmap for Internal Access Management across Kubernetes and multi-cloud environments. * Architect and implement least privilege , just-in-time access , and zero-trust models across Confluent services. * Build and evolve scalable access-authorization workflows and lifecycle management systems using technologies such as OPA , cloud IAM policies , workload identity , and internal enforcement engines. * Strengthen security boundaries through threat modeling, defense-in-depth practices, and comprehensive access-auditing capabilities. * Partner with cross-functional teams-including Platform, Kafka, Observability, Developer Productivity, Release Engineering, and SRE-to drive adoption of secure identity and access patterns. * Mentor senior engineers, elevate engineering standards, and influence architectural decisions across the organization. * Communicate complex technical decisions clearly and align stakeholders across engineering and security. ## Related Videos - [Keeping applications secure by evolving OAuth 2.0 and OpenID Connect](https://www.wearedevelopers.com/videos/100152-keeping-applications-secure-by-evolving-oauth-2-0-and-openid-connect) - [Get started with securing your cloud-native Java microservices applications](https://www.wearedevelopers.com/videos/123-get-started-with-securing-your-cloud-native-java-microservices-applications) - [Rate-limiting using eBPF and Istio: How to protect your SaaS customers from themselves](https://www.wearedevelopers.com/videos/100220-rate-limiting-using-ebpf-and-istio-how-to-protect-your-saas-customers-from-themselves) - [Monoskope: Developer Self-Service Across Clusters](https://www.wearedevelopers.com/videos/329-monoskope-developer-self-service-across-clusters) - [Delegating the chores of authenticating users to Keycloak](https://www.wearedevelopers.com/videos/1558-delegating-the-chores-of-authenticating-users-to-keycloak) - [Delay the AI Overlords: How OAuth and OpenFGA Can Keep Your AI Agents from Going Rogue](https://www.wearedevelopers.com/videos/1637-delay-the-ai-overlords-how-oauth-and-openfga-can-keep-your-ai-agents-from-going-rogue) ## Related Articles - [How We Built a Worry-Free System That Runs for 10+ Years – And What We’d Do Again](https://www.wearedevelopers.com/magazine/751-how-we-built-a-worry-free-system-that-runs-for-10-years-and-what-we-d-do-again) - [Fully Remote Software Engineer Jobs](https://www.wearedevelopers.com/magazine/447-fully-remote-software-engineer-jobs) - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [Is Software Engineering Over-Saturated?](https://www.wearedevelopers.com/magazine/418-is-software-engineering-over-saturated) - [Why Attend a Developer Event in 2026?](https://www.wearedevelopers.com/magazine/688-why-attend-a-developer-event-in-2026) - [Dev Digest 121 - AI goes offline](https://www.wearedevelopers.com/magazine/456-dev-digest-121-ai-goes-offline)