Engineering Manager, Identity & Access

**Circle** Engineering Manager, Identity & Access; $182.5K–$240K base + bonus + equity; US, Canada, or Europe (Remote)

**About Company** Circle is a global financial technology company at the forefront of the new internet of money. Our infrastructure — including USDC, a blockchain-based dollar — powers payments, commerce, and financial applications worldwide. We help businesses, institutions, and developers leverage breakthrough blockchain technologies to drive global economic prosperity and digital inclusion.

**About the Role** Circle is hiring a frontline Engineering Manager for the Identity & Access pillar — leading the team and technical direction for customer identity and access platform infrastructure while staying close enough to architecture, code, incidents, migrations, and emerging agent-identity problems to materially improve engineering quality. This is a product and platform engineering leadership role — it is NOT an employee-access administration, IT IAM, or governance role. The team owns customer sign-up/sign-in, API credentials, enterprise SSO/federation, orgs/workspaces/roles/entitlements, authorization/policy capabilities, and emerging non-human/agent identity.

**Responsibilities** - Own technical vision, architecture, and roadmap for identity and access capabilities. - Manage, coach, and grow a team of engineers while setting a high engineering-quality bar. - Lead technical designs and review critical code paths; help debug difficult production issues and participate in incident response. - Guide major migrations, cutovers, rollback planning, and architectural change. - Partner effectively with Security, Product, Risk, Onboarding, and engineering teams that integrate with identity. - Turn competing requests into a clear sequence of work and explain tradeoffs directly. - Improve operational readiness, reliability, developer experience, and engineering practices across the platform. - Engage credibly in design reviews, code reviews, architecture decisions, debugging, incident response, and prototypes when needed.

**Required Skills** A. 3+ years directly managing software engineers (hiring, coaching, performance management, conflict, developing senior engineers) — hard minimum. B. Built or technically led authentication, authorization, identity, access-control, or adjacent security-sensitive platform capabilities in production. C. Recent architecture / design ownership; stays close to code, design reviews, production debugging, incidents, and difficult engineering tradeoffs. D. Proactive security judgment — recognizes access, privilege, authentication, authorization, and blast-radius risk without waiting for Security to flag. E. Has operated systems with real users, multi-team dependencies, reliability requirements, migrations, or meaningful security consequences. F. Working knowledge of OAuth 2.x, OpenID Connect (OIDC), SAML, federation, enterprise SSO, session/token design, RBAC/ABAC, fine-grained authorization. G. AI-forward engineering judgment — uses AI as part of a disciplined workflow while independently reviewing, testing, and validating correctness.

**Bonus Skills** - Service-to-service authentication, workload identity, machine/non-human identity (SPIFFE/SPIRE patterns). - Agent and non-human identity: service/workload identity, short-lived credentials, delegated authorization, on-behalf-of patterns, agent registration/lifecycle/revocation, scoped authority, MCP authorization, workload identity federation. - MFA, passkeys, account protection, security-sensitive authentication flows. - Multi-tenant identity models, orgs/workspaces, delegated administration. - Policy engines (OPA, Cedar); zero-trust architectures.

**Logistical Info** - Location: Remote — United States or Canada (**not Montreal**). Europe is open only for exceptionally strong profiles with meaningful US Eastern-hours overlap. - Compensation: $182,500 – $240,000 base + bonus + equity. - Number of openings: 1. - **Other:** Full benefits and equity; employment eligibility to be confirmed separately per candidate; flat organization with direct communication expectations.

**Ideal Background** - Highest priority — Identity product/platform EM: engineering manager at an identity provider or identity product team who built core authentication/authorization capabilities (not implementation services or IT administration). - High priority — High-scale product identity EM at major tech / fintech / cloud / platform companies who owned customer identity, account security, authorization, federation, or access-control infrastructure. - High priority (with concrete identity ownership) — Security platform EM who built service/workload identity, access-control, credential, policy, zero-trust, or authorization systems. - Selective — Backend/platform EM with an identity transformation: strong distributed-systems leader who personally led a significant auth migration or platform build with sustained identity depth. - **Do NOT target** — Identity administrator / IAM program leader (enterprise IAM ops, vendor administration, controls, provisioning, governance without software-engineering ownership). - Sourcing pools: Okta/Auth0, Ping Identity, ForgeRock, and comparable customer-identity companies; large-scale orgs with dedicated identity / authentication / account security / authorization / infra security teams (Meta, Google, Microsoft, Apple, Cloudflare, Netflix, Uber, Stripe, Shopify, Robinhood, Coinbase — only where actual identity scope is relevant); regulated product environments (fintech, payments, crypto) when the candidate has real engineering ownership over entitlements, auditability, sensitive actions, or operational controls. - Comp note: $182.5K–$240K anchor; Matthew confirmed base + bonus + equity structure on Oct 14. Not pillar-confirmed. - 24h feedback SLA commitment from Matthew for Q4. - Canada opened as of Oct 14 (Matthew), except Montreal. Europe is this pillar's ONLY region beyond US/Canada — and only for very strong profiles. - Pillar HM: TBD (not named in brief). - Interview context: Circle AT A GLANCE for candidate prep — USDC issuer ($10T+ on-chain volume in 2025), NYSE:CRCL public since 2025, Arc L1 mainnet live Sept 16 2026 (validators include BlackRock/Visa/Mastercard/DTCC), Circle National Trust OCC approval July 2026, Agent Stack and CPN Managed Payments shipping.

**Green Flags** - Built or led core identity/authz platform; can explain architecture, tradeoffs, migrations, failures, security consequences. - Can describe a real identity/security problem that changed the design or operating model. - "I owned the architecture for a multi-tenant authorization service used by multiple product teams, including the migration path from the legacy permissions model." - "We redesigned session/token behavior after a production security issue, and I can explain the tradeoffs, rollout plan, and controls we added." - Standards-aware build-vs-buy judgment — knows when to use a hosted identity provider vs. build product-specific authz/policy layer. - Recent concrete design / code review / debugging / incident ownership; credible at a serious IC bar. - 3+ years direct reports with clear people-leadership examples (hiring, coaching, difficult performance situations). - Agent / workload identity experience — service identities, delegated authority, scoped authority, audit chains.

**Red Flags** - **Traditional banking background** — Matthew (Oct 14): "Traditional banking won't get HMs excited". Treat as a strong deprioritizer. - Primarily IT IAM — employee onboarding/offboarding, directory administration, SaaS access, endpoint tooling, or identity-vendor administration without software engineering ownership. - Governance-heavy security — GRC, audit, controls, policy, procurement, or security program leadership without hands-on engineering systems. - Professional manager with no recent technical depth; cannot explain architecture, debug difficult issues, or challenge implementation decisions. - Integration-only identity — mostly SSO / vendor integrations with little evidence of designing identity primitives, services, or platform capabilities. - Weak management evidence — tech lead with no direct reports; founder title without real people management; ambiguous team ownership; no performance-management examples. - Small/trivial complexity only — identity experience limited to environments with little scale, product complexity, or security consequences. - Generic accomplishment language — team/company outcomes without the candidate's attributable engineering decisions. - Custom-everything mindset — rebuilds security/identity primitives without compelling reasons, standards awareness, or risk controls. - Superficial AI signal — lists AI tools but cannot explain how AI changes their workflow or how they validate output. - Repeated very short roles without credible explanation. - Montreal-based candidates (geo-ineligible per Matthew's Oct 14 clarification). - Europe-based candidates below the "very strong profile" bar (Matthew's Oct 14 clarification: Europe is Identity-only, strong profiles only). - Do NOT auto-reject for: unfamiliar employer, layoff, non-linear career path, or a resume that does not explicitly mention AI — treat these as validation areas.

**Interview Process** 1. Recruiter screen with Matthew Durr. 2. AI Implementation (1h 30m, technical panel) — build a working implementation from a short product brief using an AI coding assistant, across build, test, and extend phases. 3. AI Code Review (1h, technical panel) — review a pull request in a payments codebase with the Jira ticket, PR description, CI report, and diff on hand. 4. AI Troubleshooting (1h, technical panel) — investigate a simulated production incident using logs and metrics from a webhook delivery system, review code, propose a fix. 5. Architect Interview (1h, technical panel) — describe a system you designed in the past in detail; whiteboard allowed. 6. Flight Booking Design Interview (1h, technical panel) — design a flight booking system from scratch (flights, seat inventory, reservations, payments); start by nailing down requirements, then lead the design. 7. HR Performance Management (30m, non-technical panel) — conversation with Circle HR Business Partner on performance management, values, and culture alignment. 8. Hiring Manager Interview (45m, non-technical panel) — professional/technical growth, challenges, successes. 9. Pillar Interview (45m, non-technical panel) — wide-ranging conversation with pillar leaders on leadership style, cross-functional partnership, growing engineers, setting technical direction, driving delivery.