Go Developer (IAM / ReBAC) — IaaS Platform

The Principal Recruitment agency is looking for Go developers for a company that develops public cloud services. Experience with cloud service development and Kubernetes is mandatory. Location: remote worldwide, official employment possible in various locations Salary: from $4000 Go Developer (IAM / ReBAC) — IaaS Platform

About the project: We are building a public cloud (IaaS) on our own hardware: custom virtualization on Cloud Hypervisor/KVM, distributed block storage, SDN with SRv6 and hardware offload on NVIDIA ConnectX-7 (400G), own data centers. Separately, we are building our own IAM and authorization layer for the entire platform based on OpenFGA with a ReBAC access model. We need to design a unified authorization model for all cloud resources: organizations, projects, virtual machines, networks, disks, Kubernetes clusters, and other services.

Tasks Develop the IAM and authorization service of the cloud platform. From the nearest backlog:

• Support and enhancement of the custom IAM service (oauth, OIDC, SAML, passkey, federations)
• Implement basic org/project entities in kcp
• Cover the custom IAM service with tests (authorization matrix testing, e2e, etc.)
• Design the ReBAC model in OpenFGA for organization → project → resource and inheritance of rights
• Roles and relationships between users, groups, service accounts, and resources
• Management of authorization tuples and lifecycle of relationships during resource creation, migration, and deletion
• Design tenant isolation and protection against cross-tenant access
• Migrations of the authorization model without violating existing access policies

Requirements

• Go, commercial experience from 3 years
• Practical experience implementing OIDC/etc
• Understanding of RBAC, ABAC, and ReBAC and the differences between them
• Understanding of OAuth 2.0, OpenID Connect, JWT, and service-to-service authentication
• Experience in designing complex authorization models
• OWASP Top 10
• PostgreSQL and transactional semantics
• Understanding of distributed systems: consistency, caching, idempotency
• Linux at the system engineer level

Will be a plus

• Practical experience with OpenFGA or SpiceDB
• Understanding of Google Zanzibar and tuple-based authorization
• Experience building IAM for cloud or multi-tenant systems
• Experience designing service accounts, API keys, and workload identity
• OpenTelemetry and building security audit trails

Stack Go 1.26, OpenFGA, PostgreSQL, gRPC, OpenID Connect / OAuth 2.0, Kubernetes, KCP, controller-runtime, OpenTelemetry, Talos Linux, GitLab CI