Senior Engineer - Identity Platform

• 6+ years of professional software engineering with strong, production-grade Java, including significant focus on Identity and Access Management.
• Expert Keycloak experience beyond the admin console, with hands-on SPI and extension development, realm and client architecture for multi-tenant platforms, and running Keycloak (Quarkus) in production on Kubernetes.
• Deep OAuth 2.0 and OIDC fluency, including authorization code plus PKCE, client credentials, Token Exchange (RFC 8693), JWT Bearer (RFC 7523), and refresh rotation. Working knowledge of SAML 2.0.
• Session and token architecture depth: stateful SSO sessions versus stateless JWT validation, online versus offline sessions, idle and max semantics, and JWKS validation and key rotation, with the judgment to choose per use case.
• Hands-on distributed caching and state with Infinispan or comparable technology, including clustering, persistence, expiration, and the failure modes of distributed session state.
• Production operations skill: JVM performance analysis (GC logs, heap and Metaspace sizing), correlating structured logs, and SQL-level investigation in PostgreSQL against live systems.
• Security fundamentals and communication: OWASP-aligned secure coding, threat-model thinking around token theft and replay and brute-force protection, MFA and adaptive auth, plus the ability to write a design doc that survives review and translate trade-offs for leadership.

• Healthcare integration experience, including EMR and EHR launch patterns, SMART on FHIR, or other regulated-industry SSO work.
• Identity brokering experience, including Keycloak brokering and first-login flows, or federating with managed platforms such as Google Identity Platform, Azure AD and Entra, or Okta.
• Observability with Prometheus, Grafana, or ELK, with an eye for authentication anomalies such as login-failure trends, session accumulation, and token-issuance spikes.
• Cloud security certification (AWS Security Specialty or equivalent) and a Master’s degree in Computer Science or a related field.
• Prolonged periods of sitting at a desk and working on a computer.
• Ability to operate a computer and other standard office equipment.
• Ability to communicate clearly through video, phone, and written channels in a remote-first environment.
• Occasional travel for team or company meetings may be required.

#LI-GF1 #LI-Remote

This is a senior individual-contributor engineering role.

is a base salary in the range of $135,000 to $150,000 plus an annual discretionary bonus.

Salaried employees receive DrFirst’s full standard benefits package, which includes:

• Medical, dental, and vision coverage.
• Company-paid life and disability insurance.
• 401(k) retirement plan with company match.
• Flexible and generous paid time off, plus company holidays.
• Remote-first work model with home-office support.
• Parental leave and family support benefits.
• Professional development and continuing-education support.
• Employee wellness and assistance programs.

DrFirst is committed to being a Remote-First company, creating a dynamic and flexible workplace where everyone thrives, no matter where they log in from.

Check out our approach to remote work: https://drfirst.com/company/about-us/careers/.

Our recruitment process at DrFirst is straightforward and secure.

You will only be contacted by our recruitment team through an official @drfirst.com email address.

We will never ask you for payment or sensitive personal information, such as your social security number or banking details, at any stage of the hiring process.

Additionally, we will not request that you purchase equipment or accept e-checks or checks for deposit.

If you encounter any communications claiming to be from DrFirst that seem suspicious, please contact our recruitment team directly at recruiter@drfirst.com to verify the message’s authenticity.

Your security is important to us!

Learn more about our benefits and professional development opportunities: https://drfirst.com/company/about-us/careers/the-perks/.