Senior Software Engineer - User Management

Software Mind Americas; United States; Remote; USD 140,000 - 180,000; Full time

Job summary

Software Mind is seeking a senior backend engineer to own the identity stack, focusing on authentication, authorization and tenant isolation. You will design, build and operate the User Management API, integrating Okta and Entra ID, and coordinating changes across REST and gRPC surfaces.

Collaboration with frontend and product teams is essential. The role emphasizes security, test coverage with NUnit/Moq, and on-call incident response for a cloud-based service used by multiple tenants.

Qualifications

• Hands-on identity and access management experience; production systems with IAM.
• Experience with OAuth 2.0 and OpenID Connect, PKCE, token validation and refresh flows.
• Designs for multi-tenant RBAC and tenant isolation; user lifecycle provisioning/sync.
• Experience with enterprise identity providers: Okta, Azure AD, Entra ID, Auth0 or Ping.
• SQL Server with EF Core, migrations and performance tuning.
• Designing and versioning REST APIs and gRPC/Protobuf contracts.
• Security mindset: OWASP Top 10, secret handling, least privilege.

Responsibilities

• Design, build and run features in the User Management API (tenant, landscape lifecycle, groups, RBAC).
• Own integrations with Okta and Microsoft Entra ID, including provisioning and lifecycle sync.
• Maintain authentication model and authorization rules; ensure safe upgrades of APIs.
• Version gRPC and REST contracts carefully and coordinate SDK releases.
• Manage secrets using Azure Key Vault and App Configuration.
• Support multi-tenancy, auditing and data integrity across tenants.
• Write NUnit and Moq unit tests, integration tests and smoke suites.
• Collaborate with frontend for sign-in and admin UX; coordinate with product teams.
• Participate in on-call and incident response for a cloud service.

Skills

C# / .NET back-end

IAM experience

OAuth 2.0 / OIDC

RBAC multi-tenant

Tenant isolation

User lifecycle management

SQL Server / EF Core

REST / gRPC APIs

Security best practices

On-call incident response

Tools

Okta

Azure AD

Azure DevOps

EF Core

SQL Server

Protobuf

gRPC

NUnit

Moq

Job description

Company Description

We are Software Mind, an awesome team of engineers who are ready to ramp up any top-notch company’s projects! Our aim? To always be one step ahead. Become part of a multicultural company in constant growth with an excellent work environment certified by Great Place To Work!

Job Description

• Design, build and run features in the User Management API: tenant and landscape lifecycle, user

and group administration, role-based access control, service accounts and client credentials, and audit and security support tooling.

• Own the integrations with Okta and Microsoft Entra ID. That includes provisioning, lifecycle sync,

event handling and app-registration automation, with failure modes that are safe and recoverable.

• Maintain the API's authentication model and the authorization rules behind it.
• Change and version the gRPC and REST contracts carefully, and coordinate SDK releases so the

products that consume them don't break.

• Secret management using Azure Services.
• Continue to support multi-tenancy, auditing and maintaining data integrity across tenants.
• Write tests that matter: NUnit and Moq unit tests, integration tests and automated smoke suites

focused on authentication flows, permission boundaries and tenant isolation.

• Work with frontend engineers on the sign-in and admin experience, and with product teams who

use the platform through the SDK.

• Take part in on-call and incident response for a service every PowerPlan cloud customer depends

on.

Qualifications

• 5+ years building production back-end services in C# / .NET (ASP.NET Core Web API, dependency

injection, async patterns).

• Hands-on identity and access management experience. You've built or run real systems with:
• OAuth 2.0 and OpenID Connect: authorization code with PKCE, client credentials, token validation and refresh
• WTs: claims design, validating against several issuers and audiences, signing keys and key rotation
• Multi-tenant user, role and permission models (RBAC), including tenant isolation
• User lifecycle: invitation, activation, deactivation, deprovisioning and sync with an external identity provider
• Production experience with at least one enterprise identity provider: Okta (strongly

preferred), Microsoft Entra ID / Azure AD, Auth0 or Ping or other.

• Solid relational database skills with SQL Server and EF Core, including migrations and query

performance.

• Experience designing and versioning APIs that other teams depend on (REST, and ideally gRPC /

Protocol Buffers).

• Security instincts: you know the OWASP Top 10, handle secrets carefully, write auditable code,

and default to least privilege.

Our stack

• NET 10
• ASP.NET Core
• gRPC / Protobuf
• EF Core
• SQL Server
• Okta
• Microsoft Entra ID / Graph
• Azure

Key Vault & App Configuration

• Autofac
• NLog
• NUnit / Moq
• Angular / Nx
• Azure DevOps

Nice to have

• Okta Management API / SDK, Okta event hooks and inline hooks, or Okta Identity Engine (IDX)
• Microsoft Graph, particularly app registrations, service principals and credential management
• SAML 2.0, SCIM provisioning, or enterprise SSO federation with customer identity providers
• Azure: Key Vault, App Configuration, Managed Identity, Data Protection
• Publishing and versioning internal NuGet packages (GitVersion, Conventional Commits)
• Angular or another modern front-end framework, enough to work with the portal team on sign-in

and admin screens.

• Experience in regulated industries (utilities, finance, tax) where audit trails and access reviews

matter.

• Comfort with AI-assisted development tools as part of daily work

What Success Looks Like

• First 90 days: you can run the full identity stack localy, explain how a user gets from the portal

through sign-in to an authorized API call, and you've shipped a change that crosses at least two

services.

• First year: you own a major part of the platform (for example tenant and landscape provisioning,

or the Okta and Entra integration layer), you've raised its test coverage and observability, and other

product teams come to you on identity questions.