Senior Identity & Security Engineer (Remote)

HealthEquity

Draper (UT)

Remote

USD 144,000 - 238,000

Full time

3 days ago

Be an early applicant

Application generator

A complete application in a minute — tailored resume and cover letter, ready to send.

Get past ATS filters

Benefits offered by this job

Medical, dental, and vision

HSA contribution and match

401(k) match

Paid time off

Parental leave

Gym reimbursement

Wellness program incentives

Tuition assistance

Job summary

HealthEquity is seeking a Staff Software Engineer to own the customer identity stack, including authentication, authorization and risk-based verification for a highly secure, scalable platform. You will work on passkeys, OIDC, and SAML flows, and guide the migration to modern CIAM practices while collaborating across product, security, and fraud teams.

The role emphasizes leadership in design, production telemetry and building end-to-end services with a focus on security and compliance in a

Qualifications

Seven or more years of software engineering, with at least three on authentication, identity or security-sensitive systems in production.
Deep, hands-on knowledge of OIDC, OAuth2, SAML, FIDO2 and WebAuthn, including the failure modes and the attacks against them.
Strong TypeScript and Node (NestJS) and working C# and .NET; you can read and change both codebases and choose the right one for a service.
Experience with at least one customer identity platform at scale and an informed view on build versus buy.
Cloud-native delivery on Azure or an equivalent: Kubernetes and Helm, API gateways, key vaults, managed identities, and CI/CD pipelines you have written yourself.
Comfort with GraphQL and REST API design, SQL and Postgres, and event-driven integration.
Daily fluency with AI-assisted development tools and track record of using them to raise quality and speed.
Security engineering habits: threat modeling, secure defaults, dependency hygiene, and the ability to explain a vulnerability and its fix to a non-engineer.
Clear written communication across product, fraud operations, member services and vendors, often in writing across time zones.

Responsibilities

Own technical decisions and lead design across the customer identity stack: authentication, authorization, session management, and the OIDC, OAuth2 and SAML flows for member-facing applications.
Build the services behind them end to end, including passkey registration and sign-in, step-up and out-of-band verification, and the APIs that connect our member platforms.
Own authentication journeys on our customer identity platform, from design through production telemetry, including identity verification with document and selfie checks and phone-based risk signals.
Set the standards for secure credential handling and token and session lifecycle, and partner with Information Security and Compliance on regulatory requirements.
Extend non-member authentication for employers, brokers, agents and partners, including corporate-email and phone factors, and the admin tooling around them.
Build the identity layer for the next-generation mobile app: token exchange, session and device trust, and the GraphQL and REST endpoints it consumes.
Lead parts of platform consolidation: evaluating and implementing an open-source CIAM stack, retiring legacy federation, and migration paths for member credentials.
Work with fraud team to wire risk signals into the login path: phone intelligence, device and behavioral signals, bank account verification, and the rules that act on them.
Apply agentic development practices for code review, testing and secure implementation; use AI tools and set patterns for identity engineering.
Instrument what you ship. Dashboards, alerts and queries to find the next problem before members report it.
Write architecture notes, runbooks and knowledge-base pages to scale the team’s knowledge.