Principal Platform Engineer - Authentication at IFS1

The Platform Engineering team (R&D) builds and operates the foundational infrastructure that powers IFS Cloud. We're organised into platform teams – each led by a technical lead who sets direction and leads a squad of engineers. The Identity & Access Management domain sits at the heart of IFS's platform. Every IFS product — IFS Cloud, Nexus / IFS.ai, Remote — depends on secure, reliable authentication. We're looking for a Domain Owner for Authentication: a hands-on technical leader who combines deep identity-management expertise with a platform-engineering, automation-first mindset. This is a Principal-level Architect / Team Lead role. You'll own the Authentication subdomain end-to-end: strategy, architecture, delivery, and team health. You'll partner with the Authorization Domain Owner, your domain's Program Manager, and engineering leadership to drive the IFS-wide consolidation of identity providers — with Curity positioned as the single identity platform replacing Entra ID, Keycloak, and others across IFS. We care about the quality of your experience, not just the years. A senior engineer with four years of deep, deliberate work on modern identity platforms is more interesting than someone with fifteen years of incidental exposure. What you'll own Architecture & Delivery • Architect and evolve IFS's authentication stack: Curity (strategic IDP for Nexus today, IFS-wide tomorrow), Keycloak (IFS Cloud), and legacy IFSIM. • Drive the multi-year Curity consolidation — replacing fragmented identity providers across IFS products and internal systems (Thor, time registration, internal tooling) with a single, coherent platform. • Resolve known technical debt: Curity performance bottlenecks at scale, high-latency integration flows, disaster-recovery gaps, and the long tail of non-production-ready configuration. • Define and evangelise authentication patterns across Nexus microservices, IFS Cloud, and federated customer identity providers.Platform Engineering Mindset • Treat identity infrastructure as a product with self-service, observability, and automation as first-class citizens. • Replace ticket-driven identity work with declarative, GitOps-style configuration and well-documented platform capabilities. • Partner with DevOps and SRE to improve monitoring, alerting, and DR posture for auth services deployed across Azure AKS clusters.Technical Leadership • Lead and mentor the AuthNCore squad, setting technical direction and raising the engineering bar. • Own the overall quality of code output from the squad — coding standards, code review culture, test coverage, and engineering craftsmanship are yours to set and uphold. • Work closely with your domain Program Manager to sequence and schedule delivery, balance project work against technical-debt reduction, and keep commitments realistic. • Collaborate closely with the Authorization Domain Owner (who also sits in the Identity & Access Management domain) — authentication and authorization must work as one coherent offering. • Work across product, engineering, security, and compliance to ensure authentication needs are embedded in every application and workflow. • Champion modern standards (OAuth 2.0 / OIDC, SAML, mTLS, PKCE, JWT), stay ahead of evolving trends, and bring that perspective back into IFS's roadmap.Strategy & Roadmapping • Own the Authentication roadmap — aligning it with platform priorities, security goals, and customer requirements. • Evaluate emerging technologies and vendors where relevant (without being fashion-driven). • Contribute to broader platform strategy as part of the Identity & Access Management leadership group.