Senior Backend Engineer — Platform Function:Platform Engineering

Level:Senior (SDE III+)

Location:Remote (India)

Type: Full-time About the role

We are building a multi-tenant platform that Fortune 1000 L&D; teams use to procure, configure, and deliver premium executive education inside the tools their people already use.

You would be one of the first engineers on it, and you would own the layer everything else depends on: identity, tenancy, entitlements, and audit. This is not a role where you configure an auth SDK and move on to the feature backlog. The entitlement boundary in this platform is a commercial boundary — it separates what different customers have paid for — and it is enforced in your code.

What you'll own

Identity

Enterprise SSO as a provider-side implementation, not an integration: SAML 2.0 and OIDC against Okta, Azure AD / Entra ID, Google Workspace, and Ping.

Session and token lifecycle, role mapping, just-in-time provisioning, and the long tail of enterprise IdP behaviour that no specification fully describes.

SCIM 2.0 user and group provisioning and deprovisioning, including reconciliation that leaves no orphaned accounts.

Tenancy and entitlements The tenant isolation model — you will make the row-level versus schema versus database call, implement it, document the reasoning, and own what happens when it meets its first genuinely large customer.

An entitlement policy layer that decides which tenants reach which services and which data, enforced at the identity and IAM layer rather than in the UI.

A CI test harness that fails the build if the entitlement boundary is ever violated in code — so that a future engineer cannot remove it by accident.

Audit and gateway An append-only audit log designed from the start to be exposed to customers directly, because enterprise procurement will eventually require it.

API gateway concerns alongside it — routing, request authentication, and rate limiting.

Secrets and credential handling for tenant-scoped integration configuration. What we're looking for

Must-have

5+ years backend engineering, with 2+ on platform or infrastructure surfaces — rather than exclusively product feature endpoints.

Python 3.10+ with a typed async web framework — our backend is FastAPI on Python 3.12 with Pydantic v2 and async throughout. Django REST with async, Litestar, or Flask are accepted backgrounds — we expect productivity in FastAPI within weeks. We will read code together.

PostgreSQL 14+ — schema design, indexing, EXPLAIN ANALYZE, transaction isolation levels, and a live migration you executed with a rollback plan written in advance.

SAML 2.0 and OIDC / OAuth 2.0 implemented on the provider side, against at least one major enterprise IdP — Okta, Azure AD / Entra ID, Ping, or Google Workspace. Assertion signing and validation, metadata exchange, JIT provisioning, token refresh and rotation. Protocol knowledge without a real IdP's quirks is a different skill, and we are hiring for the second one.





SCIM 2.0 — /Users and /Groups endpoints, PATCH semantics, filtering, pagination, and deprovisioning reconciliation that leaves no orphaned accounts.

Multi-tenant isolation implemented in production — PostgreSQL row-level security, schema-per-tenant, or database-per-tenant — with a transparent account of what breaks first as tenant count grows.

Authorisation modelling — RBAC or ABAC enforced server-side — with a policy engine (OPA, Casbin, Oso) or a deliberate reason you built your own.

Cloud services in production, with containerised delivery — we run on GCP — Cloud Run, Cloud SQL, Pub/Sub, Memorystore. AWS or Azure equivalents transfer. You write your own Dockerfiles and CI/CD steps rather than inheriting them.

Agentic AI development tooling in daily use — we use Claude Code; Cursor or equivalent is fine. Screened on judgment in use, not on usage itself. Nice-to-have

HR-Tech, L&D;, or EdTech background — you will meet these identity problems in a domain-specific form.

Directory synchronisation at 10,000+ user scale, including group-to-cohort mapping.

Terraform and infrastructure-as-code authored alongside your application work.

Payments, fintech infrastructure, or developer tools — domains where auth and audit are the product rather than a supporting concern.

Experience contributing evidence to a SOC 2 or ISO 27001 audit cycle.

Requirements at a glance

How to read this table. Must-have items are hard filters — a candidate missing one is not a fit for this role. Preferred items are either our actual production stack or a tie-breaker between otherwise qualified candidates; their absence disqualifies nobody. Where our stack appears in the preferred column rather than the required one, that is deliberate: we expect a strong engineer to become productive in it within weeks. A dash means there is no hard requirement in that area. Experience

5+ yrs backend; 2+ on platform or infrastructure

Early engineer at a B2B SaaS product company

Language & framework

Python 3.10+ with a typed async framework

FastAPI + Python 3.12 + Pydantic v2 — our stack

Database

PostgreSQL 14+; RLS, indexing, live migrations

TimescaleDB — our stack; pgvector

SSO

SAML 2.0 and OIDC / OAuth 2.0 — provider side

Multiple IdPs integrated in production

Enterprise IdP

Okta, Entra ID, Ping, or Google Workspace

Three or more of the four

Provisioning

SCIM 2.0 /Users + /Groups, PATCH, reconciliation

Directory sync at 10,000+ user scale

Authorisation

RBAC or ABAC enforced server-side

OPA, Casbin, or Oso in production

Cloud

Any major cloud; containerised services

GCP: Cloud Run, Cloud SQL, Pub/Sub — our stack





Delivery

Docker, Git, CI/CD authored by the candidate

Terraform + Cloud Build — our stack

Domain

HR-Tech, L&D;, EdTech, payments, or developer tools

AI tooling

Claude Code, Cursor, or equivalent in daily use

Claude Code — our stack THE IDENTITY SURFACE

These are the standards and systems you'll live in. We're looking for someone who reads this list and recognises it as home turf. Standard / Surface VS What you'll build against it

SAML 2.0 / OIDC

Provider-side single sign-on against Okta, Entra ID, Google Workspace, and Ping, with role mapping and session pass-through.

SCIM 2.0

Directory-driven provisioning and deprovisioning, group-to-cohort mapping, and reconciliation with no orphaned accounts.

Tenancy model The isolation strategy and its enforcement, plus the migration path when a customer outgrows the initial choice.

Entitlement policy

Commercial tier boundaries enforced at the IAM layer, with a CI harness that fails the build on violation.

Audit log

Append-only, tenant-scoped, and designed for eventual direct customer access via API.

API gateway

Routing, request authentication, rate limiting, and the shared middleware every service depends on. What success looks like — first 90 days

Days 1–30 — Identity service in production — SSO via SAML and OIDC, session handling, first internal consumers migrated.

Days 31–60 — Tenancy model implemented and documented; entitlement policy layer live; enforcement harness passing in CI.

Days 61–90 — SCIM provisioning live; audit service emitting; gateway authentication and rate limiting in production.

Our stack

Frontend: Next.js 14, TypeScript.

Backend: FastAPI, Python 3.12.

Data: PostgreSQL with TimescaleDB, Pub/Sub, dbt.

Infra: GCP (Cloud Run, Cloud SQL, Pub/Sub, Memorystore Redis, Vertex AI Vector Search), Terraform, Workload Identity Federation.

Intelligence layer: Anthropic Claude API.

Tooling: Claude Code as a first-class part of our development workflow.

A note on scope. This is a platform role, not a product role. Customer-facing product surfaces and the LMS/HRIS connector layer are owned by separate hires; infrastructure, Terraform, and observability are owned by a dedicated DevOps/SRE seat. You own the standards-level identity and entitlement layer that all of them depend on. How we work

Small, senior, high-trust team. We move fast, we write things down, and we hold a high engineering bar. You'll have real ownership and direct line of sight from your code to enterprise customers going live. We value people who can defend their design decisions clearly, take well-reasoned pushback, and make fast calls once convinced.

We are distributed across India and documentation-first: written decisions, service READMEs, and runbooks carry more weight here than meetings. AI development tooling is a working expectation rather than a preference — we screen for judgment in how you use it, and we evaluate the leverage you get from it.

📌 Senior Backend Engineer - Platform (India)
🏢 Emeritus
📍 India