Replit
Staff Software Engineer, Identity & Authorization
Part remote, part office, you need to live within commuting distance of a named location.
Hybrid · Foster City, CA
Employer listed it 12 days ago · Added 4 days ago
First listed 12 days ago and still open.
Salary
$250,000–$375,000
Location
Hybrid · Foster City, CA
Timezone
Not stated
Contract
Full-time
Experience
Lead
Category
Software
Published by the employer
Remote flexibility
Hybrid
This role is only partly remote, the employer expects time in the office around Foster City, CA, Hybrid, so you need to live within commuting distance.
What the employer says
- Source listing states candidate location: "Foster City, CA, Hybrid"
- Listing mentions "Hybrid"
What Nomaders makes of it
- Not suitable if you plan to move between countries
The quotes above are the employer's own words; the reading is ours. Always check the original listing and employment terms before working from another country.
About the role
Replit is the agentic software creation platform that enables anyone to build applications using natural language. With millions of users worldwide, Replit is democratizing software development by removing traditional barriers to application creation.
About the Team
Product Platform builds and owns the shared foundations the rest of Replit is built on, spanning the full stack so every other team can ship features safely and quickly.
Identity & Authorization defines how people, agents, sandboxes, and services prove who they are and what they can do. These systems protect critical product and service interactions across Replit's web product, Agent, enterprise controls, and internal services.
Our work is high-leverage and horizontal: when identity and policy are clear, reliable, and easy to adopt, every other team can move faster without rebuilding security controls.
We are a small, collaborative team that values curiosity and clear thinking over pedigree, and we work in the open by bringing each other the problem rather than just the request. We care more about how you reason and build than the route you took to get here.
About the Role
As a Software Engineer , you will design, build, and operate the identity and authorization systems that protect critical interactions on Replit, including Agent acting on behalf of a user or holding their own identity.
The work is guided by a few simple questions:
Can every protected request prove which workload made it, which principal it represents, and who is acting on that principal's behalf?
Can product teams express policy once and trust the same decision across web, mobile, Agent, and internal services?
Can enterprise administrators control who can access each workspace, app, connector, and Agent capability without navigating a permission maze as well as having a legible ledger of decisions?
Can Agent act for a user across long-running and durable work without receiving broad or long-lived credentials?
Are identity and authorization fast, reliable, highly available, and observable enough for the product flows that depend on them?
What you'll do
Design and operate central authorization interfaces with typed principals, actions, resources, decisions, explainable deny reasons, privilege attenuation, delegations, and obligations
Evolve enterprise roles, groups, app access, entitlements, and workspace policy so common cases stay simple and advanced cases remain possible
Build and operate Replit's Security Token Service and workload identity using OAuth 2.0 token exchange, JWT/OIDC, SPIFFE/SPIRE, and mTLS
Threat-model delegation, confused-deputy risks, and cross-tenant movement, then make secure, fail-closed behavior the default
Lead compatible migrations with shadow evaluation, feature gates, telemetry, and rollback plans, and own the SLOs, incidents, and operational health of the systems you ship
Partner with Agent, Connectors, Enterprise, Security, and Infrastructure teams to turn product requirements into shared platform primitives
Research and develop new innovative approaches to Authx in the Agentic world
Areas you might work in
Authorization policy : evolve Replit's central policy decision point and migrate fragmented authorization checks to its typed contract.
Requirements
- ·Experience shipping and operating security-sensitive backend or distributed systems in production, including reliability, performance, incidents, and observability
- ·Strong understanding of multi-tenant security, least privilege, delegation, privilege attenuation, auditability, and threat modeling
- ·Experience migrating security-sensitive systems without breaking callers. Approaches can include typed contracts, shadow evaluation, and staged enforcement
- ·Fluent in at least one production backend stack. Our systems use TypeScript, Go, Rust, Postgres, gRPC/Protobuf, Kubernetes, Envoy, and Restate
- ·Able to make and communicate tradeoffs across security, reliability, latency, product experience, delivery speed, and long-term maintainability
Benefits
- ·💰 Competitive Salary & Equity
- ·💹 401(k) Program with a 4% match ( US Only )
- ·⚕️ Health, Dental, Vision and Life Insurance
- ·🩼 Short Term and Long Term Disability
- ·🚼 Paid Parental, Medical, Caregiver Leave
How to apply
- 1Check the flexibility label above, hybrid, matches where you plan to live and work.
- 2Tailor your CV to the role at Replit, mentioning your remote working experience.
- 3Apply directly on the employer's careers page using the button below. Nomaders never handles your application.
Found 5d ago. Last checked today. Always confirm the details on the original posting, salary and location can change after publication.
Listing sourced from Company boards.
Similar roles
Other open software roles with comparable remote rules.
Free to apply, no account needed.
$250,000–$375,000 · You'll be taken to the employer's careers page.