Job description

At Netflix, our mission is to entertain the world. Together, we are writing the next episode - pushing the boundaries of storytelling, global fandom and making the unimaginable a reality. We are a dream team obsessed with the uncomfortable excitement of discovering what happens when you merge creativity, intuition and cutting-edge technology. Come be a part of what’s next. Since launching our ad-supported tier in 2022, the momentum has been unstoppable—we reach over 94 million global monthly active users! As we enter our fourth year , our ambition is massive, and we are just getting started. The Team The Ads Platform Foundations team builds the core platforms, frameworks, and shared services that accelerate development across the Ads organization. We focus on enabling teams to move faster and build consistently through scalable UI infrastructure, common components, and foundational workflows. Our work also powers access control across domains and underpins core systems such as Public API, GenAI foundations, and the Ads Entity Service — a knowledge graph connecting all Ads entities. Together, we provide the technical backbone that drives consistency, reliability, and velocity across Ads. Responsibilities Co-drive the build vs. buy evaluation for centralized authorization - contribute to vendor bake-offs against an in-house option, weighing latency, flexibility, operational cost, and vendor lock-in. Help design the policy model: roles vs. permissions vs. relations, org-level vs. resource-level roles, role hierarchies, resource ownership/sharing, multi-tenancy. Partner on the decision engine architecture: low-latency authorization checks, caching, consistency tradeoffs, audit/versioning of policies. Work with platform/security/IAM teams to integrate authz checks into services (sync and async enforcement points). Build reference implementations, SDKs, and middleware so other engineering teams can adopt the centralized model instead of ad hoc checks. Contribute to testing practices (policy unit tests, authorization test suites) and the migration plan from today s scattered checks to a single policy engine. Must-have qualifications 5–8 years backend/software engineering experience shipping production systems. Hands-on experience working on or building an authorization system - solid RBAC fundamentals, with real understanding of roles, permissions, role hierarchies, and resource-level vs. org-level scoping. Solid conceptual grounding in authz fundamentals - able to reason through tradeoffs between RBAC, ABAC, and ReBAC (relationship-based / Zanzibar-style) approaches. Some exposure to evaluating or integrating a policy engine/framework (Oso, OPA/Rego, Cerbos, OpenFGA, AuthZed/SpiceDB, AWS Cedar) - or having worked on an equivalent in-house. Strong systems design skills: low-latency decision services, caching, consistency vs. performance tradeoffs. Proficient in one backend stack (Java/Kotlin/Go/Node/Python). Nice-to-have Experience with policy-as-code languages (Rego, Cedar, Polar) or Zanzibar-paper-inspired systems. Has participated in a build-vs-buy or vendor RFP process before. Familiarity with AuthN (OAuth/OIDC) and how the AuthN/AuthZ boundary is typically drawn. Experience on large-scale multi-tenant SaaS platforms. Experience building this external organizations in a b2b (not just internal access controls) Open-source contributions to authz projects (OpenFGA, Cerbos, Casbin, etc.). Generally, our compensation structure consists solely of an annual salary; we do not have bonuses. You choose each year how much of your compensation you want in salary versus stock options. To determine your personal top of market compensation, we rely on market indicators and consider your specific job family, background, skills, and experience to determine your compensation in the market range. The range for this role is $388,000.00 - $558,000.00. Netflix provides comprehensive benefits including Health Plans, Mental Health support, a 401(k) Retirement Plan with employer match, Stock Option Program, Disability Programs, Health Savings and Flexible Spending Accounts, Family-forming benefits, and Life and Serious Injury Benefits. We also offer paid leave of absence programs. Full-time hourly employees accrue 35 days annually for paid time off to be used for vacation, holidays, and sick paid time off. Full-time salaried employees are immediately entitled to flexible time off. See more details about our Benefits here . Netflix is a unique culture and environment. Learn more here . Inclusion is a Netflix value and we strive to host a meaningful interview experience for all candidates. If you want an accommodation/adjustment for a disability or any other reason during the hiring process, please send a request to your recruiting partner. We are an equal-opportunity employer and celebrate diversity, recognizing that diversity builds stronger teams. We approach diversity and inclusion seriously and thoughtfully. We do not discriminate on the basis of race, religion, color, ancestry, national origin, caste, sex, sexual orientation, gender, gender identity or expression, age, disability, medical condition, pregnancy, genetic makeup, marital status, or military service.

Requirements

Must-haves

Co-drive the build vs. buy evaluation for centralized authorization - contribute to vendor bake-offs against an in-house option, weighing latency, flexibility, operational cost, and vendor lock-in.
Help design the policy model: roles vs. permissions vs. relations, org-level vs. resource-level roles, role hierarchies, resource ownership/sharing, multi-tenancy.
Partner on the decision engine architecture: low-latency authorization checks, caching, consistency tradeoffs, audit/versioning of policies.
Work with platform/security/IAM teams to integrate authz checks into services (sync and async enforcement points).
Build reference implementations, SDKs, and middleware so other engineering teams can adopt the centralized model instead of ad hoc checks.
Contribute to testing practices (policy unit tests, authorization test suites) and the migration plan from today s scattered checks to a single policy engine.
Must-have qualifications
5–8 years backend/software engineering experience shipping production systems.
Hands-on experience working on or building an authorization system - solid RBAC fundamentals, with real understanding of roles, permissions, role hierarchies, and resource-level vs. org-level scoping.
Solid conceptual grounding in authz fundamentals - able to reason through tradeoffs between RBAC, ABAC, and ReBAC (relationship-based / Zanzibar-style) approaches.
Some exposure to evaluating or integrating a policy engine/framework (Oso, OPA/Rego, Cerbos, OpenFGA, AuthZed/SpiceDB, AWS Cedar) - or having worked on an equivalent in-house.
Strong systems design skills: low-latency decision services, caching, consistency vs. performance tradeoffs.
Proficient in one backend stack (Java/Kotlin/Go/Node/Python).

Nice-to-haves

Experience with policy-as-code languages (Rego, Cedar, Polar) or Zanzibar-paper-inspired systems.
Has participated in a build-vs-buy or vendor RFP process before.
Familiarity with AuthN (OAuth/OIDC) and how the AuthN/AuthZ boundary is typically drawn.
Experience on large-scale multi-tenant SaaS platforms.
Experience building this external organizations in a b2b (not just internal access controls)
Open-source contributions to authz projects (OpenFGA, Cerbos, Casbin, etc.).
Netflix is a unique culture and environment. Learn more here .

Application prep

Use the role’s language and application details while tailoring your materials.

Keywords to mirror

apiawsjavakotlingopython

Platform: workday
Effort: long

Benefits

Benefits detected in the listing.

401(K)

Paid Time Off