Principal Software Engineer
Siteimprove is the leader in agentic content intelligence. Our platform brings accessibility, analytics, SEO/AEO, and content strategy together in one system, where AI agents work alongside marketing and digital teams to produce content that is accessible and easy to find.
Every customer, user, and increasingly every AI agent that touches the Siteimprove platform goes through systems owned by the Access team: sign-in, single sign-on, federation with customer identity providers, and the authorization layer that decides who can see and do what.
We're looking for a Software Engineer with real depth in authentication, authorization, and identity provider (IdP) systems. You'll design and build the services that secure the Siteimprove platform, work with enterprise and public-sector customers' SSO setups, help us meet FedRAMP requirements, and shape how AI agents and machine clients authenticate against our APIs and MCP servers.
This is a hands-on role with a lot of technical ownership. You'll be one of the people others on the team, and across engineering, come to with identity questions.
What we will be doing
- SSO and federation: Build and run our login, session, MFA, and token services. Own SAML and OIDC integrations with customer IdPs (Okta, Entra ID, Ping, ADFS), from metadata and certificate rotation to enterprise edge cases.
- Provisioning: Own the user lifecycle across SCIM, JIT provisioning, and deprovisioning.
- Authorization platform: Evolve our centralized permissions and authorization services, including the models (RBAC, ABAC, ReBAC), APIs, and caching, so product teams get fast, consistent access decisions.
- Agent identity: Define how AI agents, MCP servers, and integrations authenticate and get delegated, least-privilege access through OAuth 2.x (token exchange, scoped short-lived tokens), with consent and auditability built in.
- Security and compliance: Design against account takeover and token abuse. Implement FedRAMP identity controls (FAL2, signed and encrypted assertions, FIPS-validated cryptography), and work with Security and GRC on audit evidence and addressing vulnerabilities.
- Reliability: Raise the bar for reliability and observability on services where an outage means nobody can log in.
- Technical leadership: Lead design reviews and build-vs-buy decisions, mentor engineers, and be the go-to identity expert across engineering.
- Travel may be required; a valid passport is required
- Perform other duties as assigned
What we will require of you
- Engineering depth: 6+ years of professional software engineering, with at least 3 years building or running authentication, authorization, or identity systems in production.
- Backend stack: Strong backend skills in C#/.NET or Java, and a willingness to work in whichever one a given service uses.
- Protocol expertise: Deep, practical knowledge of OAuth 2.0/2.1, OpenID Connect, and SAML 2.0: grant types, token formats JWT, PKCE, token lifetimes and revocation, and assertion signing and encryption.
- IdP experience: Hands-on experience with at least one IdP, whether in-house, open source (such as Keycloak), or commercial (such as FusionAuth, Auth0, Okta, Entra ID, or Cognito), including integrating customer IdPs for enterprise SSO.
- Authorization design: Experience designing authorization models and permission services that stay correct and fast at scale.
- Security mindset: A solid grasp of identity threats (token theft and replay, session fixation, CSRF, open redirects, IdP-initiated SSO risks) and how to design against them.
- Cloud-native systems: Experience building distributed services on AWS or Azure, including containers, CI/CD, and production observability.
- AI-native delivery: You use AI tools every day to understand code, generate tests, and ship faster.
- Clear communication: You can explain a tricky identity trade-off to engineers, product managers, and auditors.
What we will love about you
- Experience with FedRAMP, or other government compliance programs, and with NIST SP 800-63 identity and federation assurance levels.
- Experience with FIPS 140-validated crypto modules, HSM or KMS-backed key management, and certificate lifecycle automation.
- Experience with policy engines or fine-grained authorization systems such as OPA, Cedar, OpenFGA, or other Zanzibar-style systems.
- Familiarity with the Model Context Protocol (MCP) authorization spec, OAuth token exchange, or workload identity (CIMD, IAM roles for service accounts).
- Experience with SCIM 2.0.
- Experience leading a migration between identity platforms without disrupting customers.
What you'll love about us
In addition, we hope you will appreciate:
At Siteimprove, we're committed to supporting your wellbeing both at work and beyond. Our Denmark benefits are designed to help you thrive personally and professionally.
Rest and relaxation: Generous time off including Danish holiday entitlements, five additional FF Days, child sick leave, and bereavement leave.
Comprehensive benefits: Health insurance, company-paid mobile phone support, and internet allowance to support your day-to-day needs.
Prepare for the future: Danica pension with employer contributions to help support your retirement goals.
FedRAMP Authorization Notice for Job Postings
This position may involve access to systems, information, or customer environments that are subject to the Federal Risk and Authorization Management Program (FedRAMP). Where applicable, FedRAMP-related responsibilities will be outlined in the job description.
If the role includes FedRAMP-related duties, candidates may be required to meet the following requirements:
Identity Verification: Candidates must successfully complete federal I-9 employment eligibility verification.
Citizenship/Residency Requirement: Certain roles may be limited to U.S. citizens or lawful permanent residents if job duties include access to controlled systems, environments, or data.
Access Authorization: Employment offers for applicable roles are contingent upon confirmation that the candidate meets the minimum access requirements associated with the FedRAMP authorization level required for the position.
By applying, you acknowledge that, if the role includes FedRAMP-related responsibilities, employment may be subject to these authorization and verification requirements.
