Staff Software Engineer

Staff Software Engineer Job Locations US-Remote Our Mission Our mission is to SAVE AND IMPROVE LIVES BY EMPOWERING HEALTHCARE CONSUMERS.Come be part of remarkable. Overview How you can make a difference HealthEquity is rebuilding how 17 million members, their employers, brokers and partners sign in and prove who they are. The Consumer Identity team owns that platform: passwordless sign-in with passkeys, identity verification, non-member authentication for employers and partners, retail enrollment, and the identity services behind our next-generation mobile app. We are in the middle of the largest change to member authentication in the company's history and are planning the next one. You will build the systems that decide whether a login is a member or an attacker. You will do it in a small senior team that owns the full stack and ships to production often. The team is led by a director who helped write the identity standards this industry uses and has shipped passkeys at consumer scale. AI-assisted development is part of how we work. What you'll be doing - Own technical decisions and lead design across the customer identity stack: authentication, authorization, session management, and the OIDC, OAuth2 and SAML flows for member-facing applications. - Build the services behind them end to end, including passkey (FIDO2 and WebAuthn) registration and sign-in, step-up and out-of-band verification, and the APIs that connect our member platforms. - Own authentication journeys on our customer identity platform, from design through production telemetry, including identity verification with document and selfie checks and phone-based risk signals. - Set the standards for secure credential handling and token and session lifecycle, and partner with Information Security and Compliance on the regulatory requirements that come with financial and health data. - Extend non-member authentication for employers, brokers, agents and partners, including corporate-email and phone factors, and the admin tooling around them. - Build the identity layer for the next-generation mobile app: token exchange, session and device trust, and the GraphQL and REST endpoints it consumes. - Lead parts of the platform consolidation: evaluating and implementing an open-source CIAM stack, retiring legacy federation, and designing the migration paths for member credentials. - Work with the fraud team to wire risk signals into the login path: phone intelligence, device and behavioral signals, bank account verification, and the rules that act on them. - Treat security findings as engineering work: triage SCA and SAST results, fix dependency and base-image vulnerabilities, keep PII out of logs, and build the checks that stop regressions. - Apply agentic development practices as a normal part of the job: author and maintain the AI agent skills and workflows the team uses for code review, testing and secure implementation, use agentic coding tools for implementation and remediation, and bring the judgment to verify what they produce. Help the team set the pattern for how identity engineering uses these tools well. - Instrument what you ship. Dashboards, alerts and queries are part of done, and you will use them to find the next problem before members report it. - Write things down. Architecture notes, runbooks and knowledge-base pages are how this team scales; your work should be understandable by the engineer who picks it up after you. What you will need to be successful - Seven or more years of software engineering, with at least three on authentication, identity or security-sensitive systems in production. - Deep, hands-on knowledge of OIDC, OAuth2, SAML, FIDO2 and WebAuthn, including the failure modes and the attacks against them. - Strong TypeScript and Node (we use NestJS) and... For full info follow application link.