Sr Staff Software Development Engineer

About the role

Diversity. Inclusion. They’re more than just words for us. They are the guiding values of how we build our teams, cultivate leaders, and create a culture where people feel connected.

We take care of our employees so they can take care of our customers. Customers who come from all walks of life just like us. We hire incredible people from diverse backgrounds because when we are different together, we are stronger together.

The Role

BeyondTrust is seeking a Senior Staff Software Development Engineer to set the technical direction for NHI Governance. NHI Governance is the Pathfinder Insights module that discovers, assesses, and remediates non-human identities — service principals, IAM users, access keys and secrets, workload identities, and AI agents — across Microsoft Entra ID, AWS, and on-premise environments. The system spans .NET 10 services over PostgreSQL; an inventory pipeline fed from governed Databricks lakehouse views; durable Temporal workflows (Python workers, a .NET gateway, protobuf contracts) that onboard, rotate, reduce access for, and decommission live customer credentials, with custody in BeyondTrust Password Safe and storage adapters for AWS Secrets Manager, Azure Key Vault, and HashiCorp Vault; and Angular micro-frontends in the Insights console. It ships through GitOps to Amazon EKS in commercial and government environments.

As one of the most senior engineers on the team, you will own the architecture across these pieces and the contracts that hold them together, lead the system from prototype to hardened production, and act as a force multiplier for a team that works in an AI-assisted, agent-native way.

What You’ll Do

- Own end-to-end architecture for NHI Governance across its services, the workflow layer it shares with the platform team, and the data lineage from the Insights lakehouse — and decide where each boundary lives.

- Design the source and vault plug-in seams (today Entra and AWS are bespoke), so a new identity source or vault becomes a repeatable, conformance-tested addition rather than a rewrite.

- Define and evolve the contracts other teams build on: service APIs and protobuf workflow schemas with breaking-change gates.

- Set the safety model for credential-lifecycle automation — rotation, decommissioning, access reduction, approvals, compensation, and points of no return — where a defect can revoke a customer's production credential.

- Define the least-privilege permission model customers grant us in Entra ID, AWS, and Password Safe, feature by feature. Own how it is verified live and explained in the product, and the setup assets (scripts, templates) that grant exactly that and no more.

- Lead the path from prototype to production: service-to-service authentication, tenant isolation, FIPS-compliant builds, and promotion through commercial and government environments.

- Design how our own services obtain identities and secrets across AWS accounts, regions, and environments — least privilege, workload identity, no long-lived keys.