Own software engineering projects end-to-end on a highly autonomous, horizontally integrated team with a lot of leverage. This is a code-forward role!

Define what identity means for autonomous agents and other non-human actors at Discord (how they're provisioned, scoped, authenticated, authorized, and audited). As the role of these actors grows, and create primitives to implement that vision.

Build and evolve Access, Discord's employee authorization platform, to make permissions discoverable, role-based, least privilege, and self-serve; check out our blog post to learn more!

Design and harden our Zero Trust architecture, spanning human and service-to-service auth*n for Discord’s internal tooling.

Automate continuous permission right-sizing in the spirit of least privilege.

Develop and apply secure baselines for cloud identity, and help secure our software supply chain from the dev environment through CI/CD and into production.

Consult on risk assessments, architectural designs, threat models, code reviews, and more, pragmatically balancing security with other business considerations.

Integrate service-to-service and agent-to-service authentication and authorization as out-of-the-box features in Discord's internal developer platform.

Build out service identity provisioning using PKI and mTLS, so services can authenticate each other without shared secrets.

Evaluate or extend infrastructure access tooling such as Teleport for short-lived, auditable access to hosts, databases, and internal systems.

Improve how secrets are issued, rotated, and scoped across our infrastructure.

5+ years of experience building and operating production systems or infrastructure

3+ years of experience writing software in a general-purpose programming language (we mainly use Python, TypeScript, and Rust)

3+ years of experience securing systems with millions of users

Experience building or operating identity and access management systems: authentication, authorization, or access control at scale

Understanding of modern authentication and authorization concepts (e.g. RBAC, OAuth, OIDC, SSO, Zero Trust network architectures, mTLS, cloud IAM)

Experience building in and securing multi-cloud environments (e.g. GCP, Cloudflare, AWS)

Experience designing and building software for customers (internal or external) beyond your immediate team

Experience defining and orchestrating containers (e.g. via Kubernetes, Docker, Distroless, OCI)

Familiarity with build and CI/CD technologies (e.g. Terraform, Bazel, Buildkite)

Provisioned or managed service and workload identity using PKI, including issuing and operating mTLS between services

Experience with Zero Trust platforms such as Cloudflare Access and Teleport, for auditable access to apps, hosts, and internal systems

Experience with secrets management systems (e.g. Vault, or a cloud KMS or secrets manager), including rotation and least-privilege access to secrets

Developed and debugged distributed systems atop GCP, Cloudflare, and/or AWS

Led complex migrations or risk management programs across an engineering organization

Built or operated a service mesh (e.g. Envoy, Istio)

Managed and secured VMs or bare-metal hosts (e.g. Linux, Salt)

Practices to discover industry tools and knowledge that can multiply your team's impact

Own software engineering projects end-to-end on a highly autonomous, horizontally integrated team with a lot of leverage. This is a code-forward role!

Define what identity means for autonomous agents and other non-human actors at Discord (how they're provisioned, scoped, authenticated, authorized, and audited). As the role of these actors grows, and create primitives to implement that vision.

Build and evolve Access, Discord's employee authorization platform, to make permissions discoverable, role-based, least privilege, and self-serve; check out our blog post to learn more!

Design and harden our Zero Trust architecture, spanning human and service-to-service auth*n for Discord’s internal tooling.

Automate continuous permission right-sizing in the spirit of least privilege.

Develop and apply secure baselines for cloud identity, and help secure our software supply chain from the dev environment through CI/CD and into production.

Consult on risk assessments, architectural designs, threat models, code reviews, and more, pragmatically balancing security with other business considerations.

Integrate service-to-service and agent-to-service authentication and authorization as out-of-the-box features in Discord's internal developer platform.

Build out service identity provisioning using PKI and mTLS, so services can authenticate each other without shared secrets.

Evaluate or extend infrastructure access tooling such as Teleport for short-lived, auditable access to hosts, databases, and internal systems.

Improve how secrets are issued, rotated, and scoped across our infrastructure.

5+ years of experience building and operating production systems or infrastructure

3+ years of experience writing software in a general-purpose programming language (we mainly use Python, TypeScript, and Rust)

3+ years of experience securing systems with millions of users

Experience building or operating identity and access management systems: authentication, authorization, or access control at scale

Understanding of modern authentication and authorization concepts (e.g. RBAC, OAuth, OIDC, SSO, Zero Trust network architectures, mTLS, cloud IAM)

Experience building in and securing multi-cloud environments (e.g. GCP, Cloudflare, AWS)

Experience designing and building software for customers (internal or external) beyond your immediate team

Experience defining and orchestrating containers (e.g. via Kubernetes, Docker, Distroless, OCI)

Familiarity with build and CI/CD technologies (e.g. Terraform, Bazel, Buildkite)

Provisioned or managed service and workload identity using PKI, including issuing and operating mTLS between services

Experience with Zero Trust platforms such as Cloudflare Access and Teleport, for auditable access to apps, hosts, and internal systems

Experience with secrets management systems (e.g. Vault, or a cloud KMS or secrets manager), including rotation and least-privilege access to secrets

Developed and debugged distributed systems atop GCP, Cloudflare, and/or AWS

Led complex migrations or risk management programs across an engineering organization

Built or operated a service mesh (e.g. Envoy, Istio)

Managed and secured VMs or bare-metal hosts (e.g. Linux, Salt)

Practices to discover industry tools and knowledge that can multiply your team's impact