Staff Software Engineer - IAM (Platform Engineering)

Geli; United States; On-site; USD 180,000 - 220,000; Full time

Job summary

Geli is looking for a Staff Software Engineer to architect and build Identity and Access Management (IAM) services for its multi-tenant SaaS platform. This role demands deep expertise in IAM systems and requires a proven track record in software engineering, particularly in designing secure systems.

The ideal candidate will possess strong knowledge of SAML, OAuth 2.0, and cloud platforms, and they will be instrumental in shaping the company’s long-term identity strategy.

Qualifications

• 10+ years of software engineering experience, including 4+ years building IAM systems.
• Deep expertise with SAML, OAuth 2.0, OIDC, SCIM.
• Expert-level proficiency in one or more backend languages and in building production services.

Responsibilities

• Architect, design, and implement IAM platform services enabling authentication and authorization.
• Define and own IAM architecture including identity boundaries.

Skills

IAM systems expertise

SAML

OAuth 2.0

OIDC

SCIM

Java

C#

Cloud platforms (Azure, AWS, GCP)

Infrastructure as Code

Docker

Kubernetes

Education

Bachelor's or Master's degree in Computer Science, Engineering, or related field

Tools

Terraform

ARM

CloudFormation

Job description

Staff Software Engineer - IAM (Platform Engineering)

Location: Santa Clara, CA, United States
Location Type: On-site
Salary Range: 180000 - 220000 USD Annually

Description

Position Summary

We are seeking a Staff Software Engineer – IAM to architect, design, and build Identity and Access Management (IAM) services for our multi‑tenant SaaS platform. This is a software engineering role—not an IT, security administration, or enterprise IAM configuration role. Candidates must have experience designing and building identity services and writing production code. You will act as a hands‑on software engineer and technical leader, owning the architecture, implementation, and evolution of authentication, authorization, and identity services. You will partner closely with Product Engineering, Security Architecture, DevOps, and Compliance to deliver secure, scalable, developer‑friendly identity capabilities. This is a greenfield/early‑stage role with significant influence over long‑term identity strategy and technical direction.

Location & Work Arrangement

• Open to candidates based in Santa Clara, CA; Seattle, WA; Houston, TX
• On‑site role with presence aligned to local team cadence and needs

Responsibilities

• Architect, design, and implement IAM platform services enabling authentication and authorization across the SaaS product
• Define and own IAM architecture: identity boundaries, trust models, access patterns, token lifecycles
• Build scalable services supporting OAuth 2.0, OIDC, SAML, and SCIM
• Develop APIs, SDKs, and tooling for safe, intuitive consumption by product teams
• Apply least‑privilege and Zero Trust principles across users, services, and infrastructure
• Lead technical decision‑making with clear tradeoffs across security, usability, and performance
• Partner with Security and Compliance for SOC 2, ISO 27001, and NIST alignment
• Drive incident response and root‑cause analysis for identity‑related issuesMentor engineers and elevate IAM engineering practices and platform reliability

Required Qualifications

• 10+ years of software engineering experience, including 4+ years building IAM systems
• Deep expertise with SAML, OAuth 2.0, OIDC, SCIM
• Bachelor’s or Master’s degree in Computer Science, Engineering, or related field (or equivalent experience)
• Experience integrating with IAM platforms (Entra ID, Okta, Ping Identity, ForgeRock) as an engineer, not an administrator
• Expert‑level proficiency in one or more backend languages (e.g., Java, C#) and in building production services (testing, observability, performance)
• Experience with cloud platforms (Azure, AWS, or GCP) and Infrastructure as Code (Terraform, ARM, CloudFormation)
• Familiarity with Zero Trust, least privilege, CI/CD, DevSecOps
• Experience with distributed systems and containers (Docker, Kubernetes)
• Ability to travel up to 10%

Preferred Qualifications

• Experience building IAM capabilities for multi‑tenant SaaS (tenant isolation, per‑tenant config, scale)
• Background in platform engineering, identity platforms, or security infrastructure engineering
• Understanding of compliance frameworks (SOC 2, ISO 27001, NIST)

The salary range is required by the California Pay Transparency Act and may differ depending on the location of those candidates hired nationwide. Actual compensation is influenced by a wide array of factors including but not limited to, skill set, education, licenses and certifications, essential job duties and requirements, and the necessary experience relative to the job’s minimum qualifications.

*This target salary range is for CA positions only and should not be interpreted as an offer of compensation.