Hiring Policy Engineers: The Complete Guide

# Policy Engineer

**Location:** San Francisco, CA (Hybrid) · **Employment Type:** Full-time · **Level:** Mid-Senior

## About [Company]

[Company] is a B2B platform serving 1,000+ enterprise customers with complex organizational structures. Authorization is critical—our customers have thousands of users, hundreds of roles, and fine-grained permission requirements that must be enforced correctly.

When authorization works, users can access exactly what they should. When it fails, sensitive data is exposed or legitimate users are blocked. Our policy infrastructure is the foundation of customer trust.

**Why join [Company]?**

- Work on authorization at enterprise scale—1000+ customers, millions of policy decisions/day
- Solve complex permission modeling problems
- Security-critical work with direct customer impact
- Join a 4-person policy team within a 150-person engineering org
- Series C company with strong enterprise traction
- Competitive compensation with meaningful equity

## The Role

We're looking for a Policy Engineer to help us build world-class authorization infrastructure. You'll work on policy engines, permission models, and the systems that control who can access what across our platform.

Authorization is harder than it looks. Customers have hierarchical organizations, inherited permissions, and edge cases everywhere. You'll translate complex business requirements into policy rules that are correct, performant, and auditable.

The ideal candidate has experience with authorization systems and understands the unique challenges: modeling real-world permission structures, scaling policy decisions, and building systems that security teams can audit.

## What You'll Work On

### First 30 Days
- Onboard to our authorization stack, policy engine, and permission models
- Understand our customer permission patterns and common requirements
- Ship your first improvement (policy feature, performance, or tooling)

### First 90 Days
- Own a policy system component (engine, modeling, or audit)
- Contribute to permission model improvements
- Build relationships with security and customer success teams
- Understand compliance requirements (SOC 2, GDPR)

### First Year
- Lead policy initiatives that improve security or customer experience
- Architect improvements to our authorization infrastructure
- Develop new permission capabilities
- Establish policy engineering best practices

## Objectives of This Role

- Maintain 99.99% policy decision availability
- Reduce policy decision latency (p99 < 10ms)
- Improve permission modeling flexibility for enterprise customers
- Build self-serve policy management for customers
- Support compliance audits with comprehensive logging

## Responsibilities

**Policy Engine (50%)**
- Build and maintain policy decision infrastructure
- Implement policy language and evaluation
- Optimize policy decision performance
- Handle policy versioning and deployment
- Build testing frameworks for policies

**Permission Modeling (30%)**
- Design flexible permission models (RBAC, ABAC, ReBAC)
- Implement inheritance and delegation
- Handle multi-tenant authorization
- Create customer-facing permission configuration
- Document permission patterns and best practices

**Security & Compliance (20%)**
- Build comprehensive audit logging
- Support compliance requirements (SOC 2, GDPR)
- Collaborate with security team on access control
- Create policy analysis and reporting tools
- Handle policy-related security incidents

## Required Skills and Qualifications

**Technical Skills**
- 5+ years of software engineering experience
- 3+ years in authorization, access control, or security
- Experience with policy engines (OPA/Rego, Cedar, Casbin)
- Deep understanding of authorization models (RBAC, ABAC, ReBAC)
- Performance optimization experience
- Proficiency in Go, Rust, or similar systems languages

**Domain Knowledge**
- Understanding of enterprise permission requirements
- Familiarity with compliance and audit requirements
- Experience with multi-tenant authorization

**Soft Skills**
- Security-first mindset
- Clear communication about complex permission models
- Collaboration with security, product, and customer teams

## Preferred Skills and Qualifications

- Multi-tenant authorization at scale experience
- Compliance background (SOC 2, FedRAMP, GDPR)
- Identity integration experience (SCIM, SAML)
- Policy language design experience
- Background in security engineering
- Published work on authorization systems

## Tech Stack

**Policy Engine:** OPA/Rego, custom extensions

**Backend:** Go for performance-critical services

**Data:** PostgreSQL, Redis for policy caching

**Infrastructure:** Kubernetes, AWS

**Audit:** Custom audit logging, compliance tooling

## Compensation and Benefits

**Salary:** $150,000 - $200,000 (based on experience)

**Equity:** 0.04% - 0.12% (4-year vest, 1-year cliff)

**Benefits:**

*Health & Wellness*
- Medical, dental, and vision insurance (100% covered)
- $100/month wellness stipend
- Mental health support through Lyra

*Time Off*
- Unlimited PTO with 15-day minimum encouraged
- 11 paid company holidays
- 16 weeks paid parental leave

*Professional Development*
- $2,500 annual learning budget
- Security and identity conferences
- Security certification support

*Financial*
- 401(k) with 4% company match
- Equity refresh grants annually

*Workspace*
- $1,500 home office setup allowance
- Hybrid work (2-3 days in SF office)
- MacBook Pro and equipment of choice

## Engineering Culture

**How we work:**
- Security-first approach to authorization
- Rigorous testing for policy changes
- Close collaboration with security team
- Compliance-aware development
- Blameless post-mortems after issues

**What we value:**
- Correctness—authorization must be right
- Performance—policy decisions must be fast
- Auditability—decisions must be traceable
- Customer flexibility—permission models must adapt
- Work-life balance (on-call is light and well-supported)

## Interview Process

Our interview process typically takes 2 weeks.

- **Step 1: Recruiter Screen** (30 min)
  Background discussion and role overview.

- **Step 2: Technical Screen** (60 min)
  Authorization concepts and systems fundamentals.

- **Step 3: Policy Deep Dive** (90 min)
  Technical discussion about permission modeling and your experience.

- **Step 4: System Design** (75 min)
  Design an authorization system component.

- **Step 5: Security Discussion** (45 min)
  Discussion with security team about threat modeling.

- **Step 6: Team Interviews** (2 x 30 min)
  Meet potential teammates.

---

*[Company] is an equal opportunity employer.*