About the role

Senior software engineer extending Auth0 and OpenFGA identity and authorization systems. Building secure permissions for human users and AI agents at Basis, a digital media automation platform.

Responsibilities

Extend the identity layer in Auth0, including authentication flows, token issuance, and identity federation
Build and maintain the ReBAC authorization model in OpenFGA
Own OAuth 2.0 and OIDC token flows, JWKS validation, scopes, and audience restrictions
Define authentication and scoped permissions for AI agents operating under the platform’s authorization model
Drive technical projects across multiple teams and systems from design through production
Set technical direction and quality standards for the team
Review shipped work against technical and quality standards
Support and mentor engineers through code reviews, design discussions, and day-to-day collaboration
Own authentication, identity, and fine-grained authorization systems for Basis’s digital media operations platform
Enable product teams through shared primitives, policies, and infrastructure

5+ years of professional software engineering experience
Deep, hands-on knowledge of OAuth 2.0 and OpenID
Experience with ReBAC systems (OpenFGA, Zanzibar, SpiceDB), including modeling schemas, writing and testing tuple-based policies, and reasoning about permission evaluation performance
Experience with Auth0 or a comparable identity provider (Okta, Azure AD, Keycloak)
Strong backend skills in Java, Ruby, or Python
Experience with frameworks such as Spring Boot, Rails, or Django
Regular use of AI coding tools (Claude Code, Cursor, Codex) for code generation, debugging, and exploring unfamiliar code
Judgment to own and vet AI-generated work
Collaborative approach to design and decision-making
Commitment to building an inclusive team
Bonus: Experience building or scaling authorization systems for complex organizational hierarchies or multi-tenant SaaS
Bonus: Familiarity with policy-as-code or attribute-based access control (ABAC)
Bonus: Background in ad tech or programmatic advertising
Bonus: Contributions to open-source identity or authorization projects
Identity, education, and employment history verification required for all hires

Flexible work week
401k/RRSP matching
Mental health support
Paid sabbaticals
Generous parental leave
Flexible work options
Competitive benefits
Flexible work options across the U.S. and Canada, including remote, hybrid, or on-site at headquarters
Optional cover letter; relevant skills not on the resume are welcomed
Interview accessibility assistance