> Markdown version of [/jobs/ext/1921734-senior-software-engineer-security](https://www.wearedevelopers.com/jobs/ext/1921734-senior-software-engineer-security). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Senior Software Engineer, Security

- **Company:** Harvey, Inc.
- **Location:** San Francisco, CA, United States
- **Experience:** Expert
- **Salary:** $220,000.0 - $330,000.0
- **Contract:** Permanent contract
- **Skills:** Amazon Web Services, Microsoft Azure, Cloud Computing, Code Review, Computer Programming, Distributed Systems, Identity and Access Management, Key Management, OpenID, Security Assertion Markup Language (SAML), Software Engineering
- **Published:** August 4, 2026
- **Apply:** https://www.indeed.com/viewjob?jk=56b9b523159fbc4e

## About the Role

* 5+ years of software engineering experience with a track record of shipping and operating production services
 * Hands-on experience building security infrastructure - IAM, authn/authz, secrets management, or privileged access
 * Working knowledge of common vulnerability classes and the ability to reason about how a system fails under an attacker, not just under load
 * Strong programming skills and a willingness to work across the stack and across unfamiliar domains
 * Fluency building and maintaining production services with agentic coding tools (Claude Code, Codex, or similar) - you know how to get real leverage from them and where they need supervision
 * Experience with cloud infrastructure (Azure, GCP, or AWS) and modern distributed system patterns
 * Demonstrated ability to turn security requirements into scalable engineering solutions rather than manual process
 * Strong communication and collaboration skills; you can influence engineering teams without formal authority

Nice to Have

 * Experience building security platforms or programs at hyper-growth startups
 * Background in developer platform or infrastructure engineering
 * Experience with SCIM, OIDC/SAML, policy engines (OPA, Cedar, Zanzibar-style systems), or hardware-backed credentials
 * Experience in highly regulated enterprise environments

## Description

* Design, build, and operate Harvey's core security services - authentication, authorization, access governance, secrets management, and privileged access - across workforce, infrastructure, and production environments
 * Own Harvey's identity infrastructure end-to-end, including SSO, SCIM, and the fine-grained authorization our enterprise customers require
 * Build secure-by-default libraries, paved-road abstractions, and self-service tooling so engineering teams can identify, remediate, and prevent security issues without waiting on us
 * Take these systems from greenfield to production-grade: define the architecture, ship it, instrument it, and own its reliability
 * Contribute to incident response and drive technical mitigation when security issues surface
 * Raise the security bar across engineering through design reviews, code reviews, and technical mentorship


## Related Videos

- [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers)
- [This Machine Ends Data Breaches](https://www.wearedevelopers.com/videos/574-this-machine-ends-data-breaches)
- [Keeping applications secure by evolving OAuth 2.0 and OpenID Connect](https://www.wearedevelopers.com/videos/100152-keeping-applications-secure-by-evolving-oauth-2-0-and-openid-connect)
- [Are Code Reviews Worth It? Insights from 16 Years of Review Data](https://www.wearedevelopers.com/videos/1135-are-code-reviews-worth-it-insights-from-16-years-of-review-data)
- [Going Beyond Passwords: The Future of User Authentication](https://www.wearedevelopers.com/videos/714-going-beyond-passwords-the-future-of-user-authentication)
- [You can’t hack what you can’t see](https://www.wearedevelopers.com/videos/41-you-can-t-hack-what-you-can-t-see)

## Related Articles

- [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed)
- [Highest Paying Tech Companies for Developers](https://www.wearedevelopers.com/magazine/220-highest-paying-tech-companies-for-developers)
- [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking)
- [The Best X (Twitter) Accounts for Developers](https://www.wearedevelopers.com/magazine/294-the-best-x-twitter-accounts-for-developers)
- [Is Software Engineering Over-Saturated?](https://www.wearedevelopers.com/magazine/418-is-software-engineering-over-saturated)
- [The Best Software Developer Blogs to Read](https://www.wearedevelopers.com/magazine/156-the-best-software-developer-blogs-to-read)