Sr Staff Software Development Engineer

Overview

Set the technical direction for NHI Governance, a Pathfinder Insights module that discovers, assesses and remediates non-human identities across Microsoft Entra ID, AWS and on-premise environments.

What you'll do

• Own end-to-end architecture for NHI Governance across its services, the shared workflow layer with the platform team, and data lineage from the Insights lakehouse, and decide where each boundary lives.
• Design the source and vault plug-in seams so a new identity source or vault becomes a repeatable, conformance-tested addition rather than a rewrite.
• Define and evolve the contracts other teams build on: service APIs and protobuf workflow schemas with breaking-change gates.
• Set the safety model for credential-lifecycle automation, including rotation, decommissioning, access reduction, approvals, compensation and points of no return.
• Define the least-privilege permission model customers grant in Entra ID, AWS and Password Safe, feature by feature.
• Own how the product verifies permissions live and explains them, and the setup assets (scripts, templates) that grant exactly that and no more.
• Lead the path from prototype to production: service-to-service authentication, tenant isolation, FIPS-compliant builds, and promotion through commercial and government environments.
• Design how our own services obtain identities and secrets across AWS accounts, regions and environments, with least privilege, workload identity and no long-lived keys.
• Partner with product, platform, data, and security leaders to align technical strategy with the roadmap, and make the build/buy and architectural trade-off calls.
• Raise how the team builds: design reviews, testing against real dependencies and live test tenants, and conventions and guardrails for AI-assisted development.
• Mentor staff and senior engineers and grow technical leadership on the team.

What you'll need

• Deep expertise architecting and operating large-scale, multi-tenant, distributed cloud services, with a track record of owning architecture across multiple teams or an entire domain.
• Expert in C#/.NET, with working proficiency in Python (equivalent depth in another typed backend language is fine if you can lead a .NET codebase).
• Production experience with durable or long-running workflow orchestration (e.g., Temporal, AWS Step Functions, Durable Functions) and event-driven systems (e.g., Kafka), including idempotency, retries, compensation and workflow versioning.
• Hands-on experience building or operating systems that create, rotate or revoke credentials (cloud access keys, service principals and app registrations, certificates, or vault-held secrets), and a sound instinct for blast radius.
• PAM or vault platform integration experience: managed accounts, rotation plugins, functional accounts.
• AWS at design level: have designed how services obtain identity and secrets in production across multiple accounts and environments, including least-privilege IAM, workload identity (e.g., IRSA or OIDC federation) instead of long-lived keys, Secrets Manager and KMS, and infrastructure as code (Terraform/Terragrunt).
• Azure at working level: Microsoft Entra ID app registrations and service principals, Microsoft Graph permissions and admin consent, managed identities, and Key Vault.
• Experience defining and versioning API and schema contracts (OpenAPI, protobuf) consumed by multiple teams.
• Production familiarity with Kubernetes (EKS preferred) and GitOps delivery.
• Excellent communication; able to influence technical direction across teams and with leadership.
• Comfortable working in an AI-assisted codebase and setting the standard for how AI-generated code is reviewed, especially changes that touch permissions.

Nice to have

• BeyondTrust Password Safe experience.
• Deep identity-security domain experience: IAM, NHI and secrets management, OAuth/OIDC, privileged access management.
• Delivery in regulated or government environments (FedRAMP, FIPS 140, AWS GovCloud).
• Additional identity models (GCP service accounts, GitHub Apps and tokens, Okta).
• Lakehouse / Databricks pipelines, including row-level security and governed data access; graph data modeling.
• Service mesh and mTLS.
• Daily hands-on practice with agentic coding tools such as Claude Code.
• Taking a module from 0 to 1 at enterprise scale.

Details

• Location: Remote Canada or Remote United States.