Team Lead Backend Engineer

About the project Xsolla ID is a strategic core service — the centralized identity provider for the entire Xsolla ecosystem. It's not just a login form; it's a comprehensive IAM platform enabling authentication and authorization across all B2C products. Products & Integrations: * Xsolla ID Platform — Core IAM service with Web2 and Web3 authentication * Authentication Widget — Universal login UI supporting multiple auth methods * SDKs — Client libraries for seamless integration across platforms * Migration Services — Zero-downtime migration from legacy Xsolla Login Auth Methods Supported: * Email + Password with secure hashing * One-time passwords (OTP) via email and SMS * Social login (Google, Apple, Steam, Discord, etc.) * WebAuthn (passkeys, biometrics) * Web3 wallet authentication * Single Sign-On (SSO) across Xsolla products Tech Stack: * Language: Go (idiomatic code, concurrency patterns, performance profiling) * Databases: MySQL, PostgreSQL (schema design, query optimization, migrations at scale), Redis * Distributed SQL: CockroachDB (multi-region deployments, clock skew handling, survivability trade-offs) for geo-distributed data residency * Message Streaming: NATS, Kafka (event-driven patterns, consumer groups, at-least-once delivery), RabbitMQ * Identity Stack: Ory ecosystem (Hydra, Kratos, Keto) with a custom Auth API orchestrator and plugin architecture * Protocols: OAuth 2.0 / OIDC (authorization code + PKCE, client credentials, device flow, token introspection, refresh strategies), WebAuthn, JWT * Web Security: cookie security, CSRF, XSS, secure token storage, TLS, secure session management, bcrypt, PKCE * Infrastructure: Docker, Kubernetes, Nginx Key Architectural Problems: * Custom auth methods without forking Ory * SSO without third-party cookies * Zero-downtime migration with bidirectional identity sync * Geo-distributed data residency via CockroachDB Team Scope: * Team of 4-6 backend engineers (target: up to 8) * Ownership of core IAM services and authentication flows * Collaboration with Frontend (widget/SDK), DevOps, and Security teams Responsibilities Technical Leadership (60%): * Own the technical strategy and architecture of the Xsolla ID IAM platform, covering authentication, authorization, and session management at scale * Design and evolve OAuth 2.0 / OIDC flows (authorization code + PKCE, client credentials, device flow), token lifecycle (introspection, refresh strategies), and security primitives to meet product and compliance requirements * Lead decisions on the Ory ecosystem (Hydra, Kratos, Keto): extending APIs, custom auth methods without forking Ory, and the custom Auth API orchestrator / plugin architecture * Own web security fundamentals across the platform: cookie security, CSRF, XSS protection, secure token storage, TLS, secure session management * Drive the CockroachDB strategy for geo-distributed data residency (multi-region deployments, clock skew handling, survivability trade-offs) * Review complex security-critical code and ensure best practices * Drive migration strategy from legacy Xsolla Login with zero downtime and bidirectional identity sync * Identify systemic risks and performance bottlenecks; lead initiatives to resolve them before they become incidents * Make key decisions on system design, security architecture, and technology choices * Maintain hands-on contribution to critical security features People Management (40%): * Lead and mentor a team of up to 8 backend engineers * Conduct regular 1:1s, performance reviews, and career development conversations * Hire and onboard new team members with IAM/security expertise * Foster a security-first culture with focus on code quality * Manage team workload and delivery commitments Delivery & Stakeholder Management: * Own team's delivery predictability for this mission-critical platform * Collaborate with Product to define IAM roadmap and priorities * Coordinate with dependent product teams (Xsolla Pay, Wallet, App, Backpack) * Report on security posture, platform reliability, and team progress QUALIFICATIONS Required: Technical Skills: * 5+ years of commercial experience with Go (or 7+ years with other backend languages with Go proficiency): idiomatic code, concurrency patterns, performance profiling * Deep expertise in OAuth 2.0 / OIDC and IAM systems: * Authorization code + PKCE, client credentials, device flow, token introspection, refresh strategies * Understanding of JWT, token refresh flows, session management * Knowledge of password hashing (bcrypt, Argon2) and secure storage * Web security fundamentals: cookie security, CSRF, XSS, TLS, secure session management * Strong knowledge of MySQL/PostgreSQL (schema design, query optimization, migrations at scale) and Redis * Experience with distributed systems and their trade-offs (consistency, availability, failure modes) * Experience with high-availability system design (99.9%+ uptime requirements) * Understanding of security best practices and common vulnerabilities (OWASP) * Experience with Docker, Kubernetes, and production deployments Leadership Skills: * 2+ years of experience leading engineering teams * Track record of delivering mission-critical infrastructure * Proven ability to lead multi-quarter technical initiatives across teams and influence architecture beyond the immediate team * Experience with security-focused code review processes * Strong written and verbal communication — RFCs and design docs that people actually read * Ability to balance security requirements with delivery timelines Preferred: * Hands-on experience with the Ory ecosystem (Hydra, Kratos, Keto) — operating it in production or building on top of its APIs * Experience with CockroachDB or other distributed SQL databases (multi-region deployments, clock skew handling, survivability trade-offs) * Experience with NATS or Kafka — event-driven patterns, consumer groups, at-least-once delivery * Experience with WebAuthn/FIDO2 passkey implementations * Knowledge of Web3 authentication (wallet signatures, EIP-4361) * Experience building or integrating with SCIM, SAML, or enterprise SSO (LDAP / Active Directory) * Background in fintech, payments, or gaming identity systems * Familiarity with compliance requirements relevant to IAM: SOC 2, ISO 27001, PCI DSS, GDPR data minimization, audit logging * Contributions to open-source security or identity projects * Background in platform or infrastructure engineering — building systems other engineers build on top of * Experience with large-scale user migrations (millions of accounts) * Practical, up-to-date experience with modern AI tools (e.g. Claude, Copilot, Cursor) for code generation, review, and accelerating day-to-day engineering work WHAT SUCCESS LOOKS LIKE First 3 months: * Deep understanding of Xsolla ID architecture and security requirements * Established team rituals and 1:1 cadence * Delivered improvements to at least one critical authentication flow First 6 months: * Team consistently delivers secure, well-tested code * Progress on migration from legacy Xsolla Login * Improved platform reliability metrics First year: * Xsolla ID successfully serving multiple B2C products * Team grown and developed with clear succession planning * Platform achieving target availability (99.9%+) and security posture