Sr. Software Engineer, Identity & Zero Trust Platform

About the role

Sr. Software Engineer, Identity & Zero Trust Platform | Tesla (Engineering & Information Technology)

Location: PALO ALTO, California | Req ID: 275209 | Job Type: Full-time

What to Expect

At Tesla, we are building the future of identity in-house.

As a Senior Software Engineer on the Identity & Zero Trust Engineering team, you will own the design and development of the platforms that secure every human and workload at Tesla across our identity provider (IdP/SSO), Identity Governance & Administration (IGA), workload identity (SPIFFE/SPIRE), Public Key Infrastructure (PKI), Zero Trust Network Access (ZTNA), and infrastructure access strategy.

This is a hands-on, build-first engineering role: you will write production software (primarily Go and Python) that replaces commercial point-solutions with scalable, highly available services we own end to end, and you will set the technical direction for how identity and access are engineered across the company.

What You'll Do

• Design, build, and own production services across the identity and Zero Trust stack: IdP/SSO, IGA, workload identity, PKI, ZTNA, and infrastructure access focused on developing in-house rather than bought
• Architect workload identity using SPIFFE/SPIRE as the cryptographic root of trust, issuing short-lived identities and securing service-to-service traffic with mTLS
• Build a centralized authorization platform (ABAC/RBAC, policy-as-code) that operates on the hot path at high request rates with sub-millisecond p99 latency and high availability
• Develop the IGA platform: just-in-time access, birthright/role-based provisioning, access reviews, separation-of-duties, and automated evidence collection for SOX/PCI and audits
• Own internal PKI: certificate issuance, rotation, and revocation; certificate-lifecycle automation; HSM-backed key management; and shared mTLS/PKI libraries
• Build Zero Trust infrastructure access: short-lived, certificate-based access to SSH, Kubernetes, and production systems via identity-aware proxies/bastions, eliminating standing access and static keys
• Develop identity-aware gateways/proxies and integrations with the IdP (Entra/Azure AD), SCIM provisioning, and downstream services
• Build Kubernetes controllers/operators for service-identity and authorization-policy custom resources; integrate with the service mesh (Istio/Envoy)
• Define identity and authorization design standards; lead design and pre-launch security reviews; mentor engineers and raise the engineering bar across teams
• Drive reliability and operability: observability, automated testing, safe rollout/rollback, and secure software-development practices

What You'll Bring

• 6+ years of software engineering experience building and operating production distributed system
• Expert proficiency in Go and/or Python as primary build languages, with strong backend/systems fundamentals (working knowledge of C#, TypeScript, or Rust a plus)
• Demonstrated experience building (not just operating) software in multiple identity/security domains: workload identity (SPIFFE/SPIRE), PKI/X.509/mTLS, IGA, authorization (ABAC/RBAC/OPA), SO/identity protocols, or infrastructure access
• Track record of designing and shipping high-scale, low-latency, highly available services with clear ownership of throughput, latency, and availability outcomes
• Strong understanding of identity and access protocols: OIDC, OAuth2, SAML, SCIM, JWT/JWKS, and X.509/mTLS
• Deep Kubernetes experience, including controllers/operators and service mesh (Istio, Envoy, Consul, or Cilium)
• Proficiency in API design (REST, gRPC) and integration patterns (event-driven, webhooks, message queues)
• Experience with cloud platforms (Azure, AWS, GCP) and their IAM/networking primitives

Strong software-engineering practices: Git, code review, automated testing, CI/CD, observability, and secure coding

• Degree in Computer Science, Software Engineering, or equivalent work experience
• Effective verbal and written communication and the ability to lead technical design

Benefits

Along with competitive pay, as a full-time Tesla employee, you are eligible for the following benefits at day 1 of hire:

• Medical plans > plan options with $0 payroll deduction
• Family-building, fertility, adoption and surrogacy benefits
• Dental (including orthodontic coverage) and vision plans, both have options with a $0 paycheck contribution
• Company Paid (Health Savings Accounts) HSA Contribution when enrolled in the High-Deductible medical plan with HSA
• Healthcare and Dependent Care Flexible Spending Accounts (FSA)
• 401(k) with employer match, Employee Stock Purchase Plans, and other financial benefits
• Company paid Basic Life, AD&D
• Short-term and long-term disability insurance (90 day waiting period)
• Employee Assistance Program
• Sick and Vacation time (Flex time for salary positions, Accrued hours for Hourly positions), and Paid Holidays
• Back-up childcare and parenting support resources
• Voluntary benefits to include: critical illness, hospital indemnity, accident insurance, theft & legal services, and pet insurance
• Weight Loss and Tobacco Cessation Programs
• Tesla Babies program
• Commuter benefits
• Employee discounts and perks program
• Earned Wage Access: Real-time pay access paid daily, subject to eligibility and schedule (applicable for below Sr. Managers levels)

Expected Compensation$140,000 - $252,000/annual salary + cash and stock awards + benefitsPay offered may vary depending on multiple individualized factors, including market location, job-related knowledge, skills, and experience. The total compensation package for this position may also include other elements dependent on the position offered. Details of participation in these benefit plans will be provided if an employee receives an offer of employment.