Find The RightJob.

RBAC Python Engineer

We are seeking a senior software engineer to lead the design and implementation of a production-grade Role-Based Access Control (RBAC) system for an open-source ML infrastructure stack using MLRun and Nuclio. This greenfield project will replace a commercial RBAC system with a custom authorization layer that is functionally equivalent, operationally simple, and aligned with enterprise security expectations. The successful candidate will architect and deliver a complete authorization system integrated with our identity provider, MLRun API, and Nuclio API, supporting 75+ active users across multi-cluster, multi-AWS-account deployments.

Project Scope & Deliverables

This is a six-month engagement. The contractor will deliver a production-ready, fully functional RBAC stack, including the following components:

1. Authorization Service — Python/FastAPI Backend

Multi-tenant permission management and policy evaluation
Integration with external identity provider, such as Azure Entra
OPA/Rego-compatible API endpoints for MLRun and Nuclio
Session verification and identity resolution through access keys and cookies

2. User, Group, and Access Key Management API

Full CRUD operations for users, groups, and role assignments
Audit logging and compliance-ready change tracking
Cascading delete logic and data integrity safeguards

3. Admin UI — React/TypeScript

Clean dashboard for user, group, and permission management
Bulk import and export support using YAML
Real-time permission visibility

4. Data Persistence and High Availability

Multi-AZ and multi-region deployment design for high availability
Persistent storage layer for audit logs, user state, and configuration
Performance optimization to minimize authorization-check latency

5. MLRun and Nuclio Integration

Native integration with the MLRun API for authorization decisions on projects, runs, and artifacts
Seamless login flow and UI authentication for MLRun and Nuclio
Token and session management compatible with MLRun request flows

6. Documentation and Handoff

Operator runbooks and support documentation
Knowledge transfer sessions with the internal development team

Required Skills and Experience

5+ years of backend software engineering experience, preferably with Python
Demonstrable experience designing and implementing authentication, authorization, or other security-critical infrastructure
Demonstrable experience with Kubernetes production deployments, including multi-cluster architecture, configuration management, and high-availability patterns
Proficiency with at least one external identity provider, such as Azure Entra, AWS Cognito, Okta, or OIDC
Proficiency in policy-as-code concepts, with OPA/Rego strongly preferred
Proficiency with AI-assisted coding tools
Operational mindfulness, including the ability to design for simplicity, monitoring, and debuggability
Clear communication, including the ability to explain architecture decisions to both technical and non-technical stakeholders

Preferred Qualifications