# Member of Technical Staff (Software Engineer, Enterprise Trust & Governance)
**Company:** [Perplexity AI](https://scaleengineer.com/companies/perplexity)
Join Perplexity AI's Enterprise Trust & Governance team as a Member of Technical Staff to architect and build the control plane that enables Fortune 500 organizations to securely deploy AI agents at scale. You'll own end-to-end product and platform engineering across identity and access management, fine-grained authorization, policy enforcement, audit infrastructure, and compliance controls—translating complex enterprise requirements into elegant, reliable systems that give administrators and security teams the confidence to govern AI across their organizations.
**Role:** Backend Engineer
**Seniority:** Senior
**Locations:** San Francisco
**Salary:** 220000–405000 USD
[Apply](https://jobs.ashbyhq.com/perplexity/63785f62-07ac-4dc5-8f68-57779dddb1f3)
Canonical: https://scaleengineer.com/jobs/perplexity/member-of-technical-staff-software-engineer-enterprise-trust-governance
---
## Responsibilities

- Enterprise Identity & Provisioning Architecture: Own the complete identity and provisioning infrastructure including SAML/OIDC single sign-on implementation, SCIM protocol support, and integrations with enterprise identity providers like Okta and Microsoft Entra ID. Design secure authentication flows that scale across multi-tenant environments while maintaining strict data isolation and compliance with enterprise security standards.
- Fine-Grained Authorization Platform: Design and implement a comprehensive permissions platform supporting granular role-based access control (RBAC) across connectors, tool actions, model invocations, and agent workflows. Build enforcement mechanisms that ensure consistent authorization decisions across all product surfaces and establish the technical foundation for attribute-based access control (ABAC) expansion.
- Secure Admin APIs & Documentation: Architect and ship production-grade REST/GraphQL admin APIs with comprehensive documentation for audit logs, member management, group administration, role configuration, and system settings. Implement rate limiting, authentication, and authorization at the API layer with comprehensive error handling and versioning strategies for enterprise customers.
- Policy Controls & Model Governance: Build sophisticated policy engines for model and feature availability, progressive rollout strategies, model deprecation handling, usage limits, spend caps, budget alerts, and cost-center allocation. Create flexible policy configuration systems that allow enterprises to implement complex governance rules without requiring engineering changes.
- Admin Analytics & Dashboards: Develop comprehensive analytics and reporting infrastructure for adoption metrics, usage patterns, spend tracking, and policy enforcement visibility. Build intuitive admin dashboards that help enterprise organizations measure ROI, track governance compliance, and make data-driven decisions about AI deployment across their environments.
- Audit Logging & Compliance Infrastructure: Engineer audit log systems that capture all configuration changes, user activities, and policy enforcement events with immutable storage and tamper-proof design. Implement change notification systems and compliance reporting that help administrators investigate security incidents, track governance changes, and satisfy regulatory requirements like SOC 2, HIPAA, and FedRAMP.
- Authorization Correctness & Reliability: Establish the technical and cultural standard for authorization security across engineering teams through system design reviews, permission check optimization, consistent failure mode handling, and tenant isolation verification. Mentor other engineers on secure-by-default authorization patterns and drive adoption of authorization testing frameworks and security best practices.
- Cross-Functional Platform Strategy: Collaborate with Product, Design, Security, Sales, and Customer Success teams to translate enterprise customer requirements into reusable platform primitives. Lead architecture discussions that balance security, scalability, usability, and delivery velocity while maintaining long-term platform extensibility and reducing future technical debt.

## Requirements

### education

- {"name":"Computer Science or Related Field","description":"Bachelor's degree in Computer Science, Software Engineering, or equivalent field demonstrating strong foundational knowledge in data structures, algorithms, and system design principles. Advanced degree in related field is valued but not required."}

### technical

- {"name":"Backend Language Expertise","description":"Expert-level proficiency in at least one modern backend language such as Python, Go, or Rust. Demonstrate deep understanding of language-specific patterns for building highly available, concurrent systems with strong typing and performance characteristics suitable for authorization and policy enforcement workloads."}
- {"name":"Cloud Infrastructure & Kubernetes","description":"Hands-on production experience with AWS services (EC2, RDS, DynamoDB, S3, Lambda, managed Kubernetes) or equivalent cloud platforms. Practical expertise in containerization, orchestration, observability, and deploying resilient multi-tenant systems at scale with strong security posture and regulatory compliance."}
- {"name":"Distributed Systems Design","description":"Proven ability to design scalable, reliable systems handling eventual consistency, distributed transactions, and data synchronization. Experience with patterns like saga transactions, event sourcing, caching strategies, and CQRS for enterprise SaaS platforms serving thousands of organizations."}
- {"name":"Enterprise Identity & Access Management","description":"Deep expertise in OAuth 2.0, OpenID Connect (OIDC), SAML 2.0, SCIM, and enterprise provisioning protocols. Experience architecting or maintaining enterprise identity systems including integration with providers like Okta, Microsoft Entra ID (formerly Azure AD), or Ping Identity. Understanding of JWT, token refresh flows, and token lifecycle management in multi-tenant contexts."}
- {"name":"Fine-Grained Authorization Systems","description":"Expert knowledge of authorization patterns including role-based access control (RBAC), attribute-based access control (ABAC), and context-based authorization. Experience designing permission models, building authorization decision engines, and implementing consistent enforcement across complex permission hierarchies and inheritance scenarios."}
- {"name":"Encryption & Key Management","description":"Strong understanding of encryption fundamentals, customer-managed key (CMK) architectures, key lifecycle management (generation, rotation, revocation), and hardware security modules (HSM). Experience with compliance requirements around encryption including FIPS 140-2 validation and regulatory frameworks for sensitive data protection."}
- {"name":"Audit & Compliance Infrastructure","description":"Practical experience building immutable audit log systems, implementing compliance controls for SOC 2, HIPAA, FedRAMP, and GDPR. Knowledge of audit trail design patterns, retention policies, change detection, and compliance reporting automation suitable for enterprise governance requirements."}
- {"name":"Database Design for Multi-Tenancy","description":"Expertise in multi-tenant database architectures balancing tenant isolation, query performance, and operational simplicity. Experience with relational databases (PostgreSQL, MySQL), NoSQL options (DynamoDB, MongoDB), and patterns for preventing data leakage while maintaining queryability and backup strategies."}

### experience

- {"name":"Enterprise Backend Systems","description":"4+ years of professional software engineering experience with demonstrated track record owning complex backend systems through design, implementation, testing, deployment, and production operations. Experience scaling systems to serve millions of requests and thousands of enterprise customers."}
- {"name":"Multi-Tenant SaaS Platform Development","description":"2+ years building production multi-tenant SaaS platforms with experience designing clear security boundaries, implementing tenant isolation, managing data privacy concerns, and handling complex compliance requirements. Proven ability to balance consistency with scalability in shared infrastructure."}
- {"name":"Enterprise Identity & Provisioning","description":"2+ years working with enterprise identity systems, including building or integrating SSO/SAML implementations, SCIM provisioning workflows, or maintaining identity platform infrastructure. Experience working with enterprise identity platforms such as WorkOS, Okta, Azure AD, or similar vendors."}
- {"name":"Authorization & Security Systems","description":"2+ years developing permission platforms, authorization enforcement systems, or security-critical infrastructure. Track record of making thoughtful technical decisions in threat models and authorization correctness where misconfigurations could have significant security impact."}
- {"name":"Cross-Team Leadership & Platform Ownership","description":"Demonstrated ability to lead ambiguous, cross-functional initiatives from architecture through adoption. Track record of setting technical direction for shared platform systems, raising overall engineering quality through code review and mentorship, and balancing stakeholder needs across Product, Design, Security, and Operations teams."}
- {"name":"Enterprise Admin Platform Experience","description":"1+ years building admin-facing platforms, dashboards, or infrastructure including analytics for adoption and usage, with understanding of user experience considerations unique to system administrators and operations teams. Experience translating complex operational requirements into usable interfaces and scalable systems."}

## Skills

### required

- {"name":"Python / Go / Rust Backend Development","description":"Production-grade expertise in at least one modern backend language for building scalable, reliable microservices and distributed systems."}
- {"name":"AWS Cloud Platform","description":"Hands-on experience with AWS services including compute, storage, managed databases, and containerized workloads for multi-tenant enterprise systems."}
- {"name":"OAuth 2.0 / OIDC / SAML 2.0","description":"Deep understanding of industry-standard enterprise authentication protocols and practical experience implementing or integrating these standards into production systems."}
- {"name":"Role-Based Access Control (RBAC)","description":"Strong expertise in designing and implementing fine-grained permission systems with role hierarchies, permission inheritance, and consistent enforcement."}
- {"name":"Multi-Tenant Architecture","description":"Proven ability to design systems with robust tenant isolation, preventing data leakage, and scaling efficiently across thousands of enterprise customers."}
- {"name":"System Design & Architecture","description":"Strong system design skills including reliability patterns, scalability considerations, security boundaries, and balancing trade-offs between consistency, availability, and latency."}
- {"name":"API Design & Implementation","description":"Expertise designing and building secure, well-documented REST/GraphQL APIs for admin and customer-facing use cases with proper versioning, rate limiting, and error handling."}
- {"name":"Database Design","description":"Strong experience with relational databases (PostgreSQL) and query optimization for complex permission and audit queries at scale."}

### preferred

- {"name":"Okta / Microsoft Entra ID Integration","description":"Hands-on experience integrating with or building identity platform connectors for Okta, Microsoft Entra ID, or other enterprise identity providers."}
- {"name":"SCIM Protocol Implementation","description":"Experience implementing SCIM for user and group provisioning automation in enterprise environments."}
- {"name":"Customer-Managed Key (CMK) Architecture","description":"Experience designing and implementing customer-managed encryption key systems with secure key lifecycle management and audit trails."}
- {"name":"Kubernetes & Container Orchestration","description":"Hands-on experience with Kubernetes for deploying and operating highly available services in production environments."}
- {"name":"Compliance Frameworks (SOC 2 / HIPAA / FedRAMP)","description":"Experience building systems designed to meet enterprise compliance requirements and working with security/compliance teams during audit processes."}
- {"name":"GraphQL API Development","description":"Experience building GraphQL APIs for internal admin tools or customer-facing applications with strong typing and query optimization."}
- {"name":"Observability & Distributed Tracing","description":"Proficiency with observability platforms like Datadog, New Relic, or Grafana for debugging distributed systems and monitoring authorization decision latency."}
- {"name":"Event Streaming & Message Queues","description":"Experience with Kafka, RabbitMQ, or similar systems for building audit log pipelines, change notifications, and event-driven compliance workflows."}
- {"name":"Agent Framework Architecture","description":"Familiarity with large language model (LLM) agent frameworks, AI agent execution contexts, and the unique security and governance challenges of autonomous AI systems."}

## Tech stack

### tools

### others

### databases

### languages

### frameworks

## Benefits

### benefits

## Compensation

- **max:** 0
- **min:** 0
- **currency:** 
- **stockOptions:** false

## Interview process

### steps

## Full description
## About the Role

The Enterprise Trust & Governance team builds the control plane that lets the world’s largest organizations deploy Perplexity broadly and with confidence. Computer and our agents work across a growing share of our customers’ environments, tools, and models. For administrators, that makes precise, enforceable control essential: who can do what, with which data, through which agents, and within what usage limits. This team makes those controls easy to manage, reliable and consistent across every product, and transparent to the people accountable for them.

This is a product and platform engineering role with end-to-end ownership, from shaping the architecture and policy models to shipping the experiences our customers’ administrators and security teams use every day. You’ll work across product and infrastructure teams to turn complex enterprise requirements into reusable primitives and intuitive controls. The scope spans identity and provisioning, fine-grained role-based access across connectors, tool actions, and models, customer-managed encryption keys, admin APIs, audit logs, and policy and usage controls. Strong governance helps enterprises move from pilots to company-wide rollouts and gives them the confidence to entrust agents with greater responsibility over time.

## Key Responsibilities

* Own enterprise identity and provisioning, including SSO (SAML/OIDC), SCIM, WorkOS integrations, and support for identity providers such as Okta and Microsoft Entra ID.
* Build the permissions platform, with fine-grained roles and permissions for connectors, tool actions, models, and model effort levels, enforced consistently across products and agent workflows.
* Design and ship secure, well-documented admin APIs for audit logs, members, groups, roles, and settings.
* Build policy controls for model and feature availability, staged rollouts, model deprecations, usage and spend limits, alerts, and cost-center allocation.
* Build admin-facing analytics for adoption, usage, spend, and policy enforcement, helping organizations measure value and manage their deployments.
* Deliver audit logs and change notifications that help administrators investigate activity, track configuration changes, and support compliance.
* Set the technical bar for authorization correctness and reliability, with fast, consistent, explainable permission checks, well-defined failure behavior, and strong tenant isolation.
* Partner with Product, Design, Security, Sales, and Customer Success to translate complex enterprise requirements into reusable platform capabilities and intuitive admin experiences.

## Qualifications

* 4+ years of software engineering experience, with a track record of owning complex backend systems from design through production operation.
* Strong system design skills, including building reliable, scalable, multi-tenant SaaS platforms with clear security and isolation boundaries.
* Strong proficiency in a backend language such as Python, Go, or Rust, and hands-on experience with cloud infrastructure such as AWS and Kubernetes.
* Deep expertise in at least one of the following:

  * Enterprise identity and provisioning, including OAuth, OIDC, SAML, and SCIM.
  * Permissions platforms, fine-grained authorization, and policy enforcement.
  * Encryption, customer-managed keys, and key lifecycle management.
  * Enterprise admin platforms, audit infrastructure, or usage and spend analytics.
* Experience building or integrating enterprise identity and access systems, including platforms such as WorkOS, Okta, or Microsoft Entra ID.
* Sound technical judgment in security-sensitive systems, balancing threat models, authorization correctness, and failure behavior with usability and delivery speed.
* A track record of leading ambiguous, cross-team initiatives from architecture through adoption, setting technical direction for shared platforms, and raising engineering quality through mentorship.

If you’re excited about this role, we encourage you to apply even if you don’t meet every qualification. We value demonstrated impact, deep ownership, and the initiative to turn ambiguity into results.