> Markdown version of [/jobs/ext/4450531-staff-software-engineer](https://www.wearedevelopers.com/jobs/ext/4450531-staff-software-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Staff Software Engineer - **Company:** HealthEquity Inc. - **Location:** Draper, UT, United States (Remote available) - **Experience:** Expert - **Salary:** $144,000.0 - $237,500.0 - **Contract:** Permanent contract - **Skills:** .NET Framework, Microsoft Azure, Cloud Engineering, Code Review, Cyber Security, Mobile Application Software, PostgreSQL, Node.Js, OAuth, Open Source Technology, OpenID, Ping (Networking Utility), Runbook, Security Assertion Markup Language (SAML), Software Engineering, SQL Databases, TypeScript, Okta, Agentic-AI, Customer Identity Access Management, Kubernetes, Codebase, Graphql, Virtual Agents, Api Gateway, NestJS, Restful APIs, Static Application Security Testing - **Published:** October 9, 2026 - **Apply:** https://diversityjobs.com/career/18611177/Staff-Software-Engineer-Utah-Draper ## About the Role Seven or more years of software engineering, with at least three on authentication, identity or security-sensitive systems in production. - Deep, hands-on knowledge of OIDC, OAuth2, SAML, FIDO2 and WebAuthn, including the failure modes and the attacks against them. - Strong TypeScript and Node (we use NestJS) and working C# and .NET; you can read and change both codebases and choose the right one for a service. - Experience with at least one customer identity platform at scale (for example Transmit Security, Ory, Ping, Duende IdentityServer, Auth0 or Okta), and an informed view on build versus buy. - Cloud-native delivery on Azure or an equivalent: Kubernetes and Helm, API gateways, key vaults, managed identities, and CI/CD pipelines you have written yourself. - Comfort with GraphQL and REST API design, SQL and Postgres, and event-driven integration. - Daily fluency with AI-assisted development tools, hands-on experience building or orchestrating AI agents in day-to-day development, and a track record of using them to raise quality and speed, not just output. - Security engineering habits: threat modeling, secure defaults, dependency hygiene, and the ability to explain a vulnerability and its fix to a non-engineer. - Clear written communication. You will work with product, fraud operations, member services and vendors, often in writing and often across time zones. ## Description Own authentication journeys on our customer identity platform, from design through production telemetry, including identity verification with document and selfie checks and phone-based risk signals. - Set the standards for secure credential handling and token and session lifecycle, and partner with Information Security and Compliance on the regulatory requirements that come with financial and health data. - Extend non-member authentication for employers, brokers, agents and partners, including corporate-email and phone factors, and the admin tooling around them. - Build the identity layer for the next-generation mobile app: token exchange, session and device trust, and the GraphQL and REST endpoints it consumes. - Lead parts of the platform consolidation: evaluating and implementing an open-source CIAM stack, retiring legacy federation, and designing the migration paths for member credentials. - Work with the fraud team to wire risk signals into the login path: phone intelligence, device and behavioral signals, bank account verification, and the rules that act on them. - Treat security findings as engineering work: triage SCA and SAST results, fix dependency and base-image vulnerabilities, keep PII out of logs, and build the checks that stop regressions. - Apply agentic development practices as a normal part of the job: author and maintain the AI agent skills and workflows the team uses for code review, testing and secure implementation, use agentic coding tools for implementation and remediation, and bring the judgment to verify what they produce. Help the team set the pattern for how identity engineering uses these tools well. - Instrument what you ship. Dashboards, alerts and queries are part of done, and you will use them to find the next problem before members report it. - Write things down. Architecture notes, runbooks and knowledge-base pages are how this team scales; your work should be understandable by the engineer who picks it up after you.