The posting
Diversity. Inclusion. They’re more than just words for us. They are the guiding values of how we build our teams, cultivate leaders, and create a culture where people feel connected.
We take care of our employees so they can take care of our customers. Customers who come from all walks of life just like us. We hire incredible people from diverse backgrounds because when we are different together, we are stronger together.
The Role
BeyondTrust is seeking a Senior Staff Software Development Engineer to set the technical direction for NHI Governance. NHI Governance is the Pathfinder Insights module that discovers, assesses, and remediates non-human identities — service principals, IAM users, access keys and secrets, workload identities, and AI agents — across Microsoft Entra ID, AWS, and on-premise environments. The system spans .NET 10 services over PostgreSQL; an inventory pipeline fed from governed Databricks lakehouse views; durable Temporal workflows (Python workers, a .NET gateway, protobuf contracts) that onboard, rotate, reduce access for, and decommission live customer credentials, with custody in BeyondTrust Password Safe and storage adapters for AWS Secrets Manager, Azure Key Vault, and HashiCorp Vault; and Angular micro-frontends in the Insights console. It ships through GitOps to Amazon EKS in commercial and government environments.
As one of the most senior engineers on the team, you will own the architecture across these pieces and the contracts that hold them together, lead the system from prototype to hardened production, and act as a force multiplier for a team that works in an AI-assisted, agent-native way.
What You’ll Do
- Own end-to-end architecture for NHI Governance across its services, the workflow layer it shares with the platform team, and the data lineage from the Insights lakehouse — and decide where each boundary lives.
- Design the source and vault plug-in seams (today Entra and AWS are bespoke), so a new identity source or vault becomes a repeatable, conformance-tested addition rather than a rewrite.
- Define and evolve the contracts other teams build on: service APIs and protobuf workflow schemas with breaking-change gates.
- Set the safety model for credential-lifecycle automation — rotation, decommissioning, access reduction, approvals, compensation, and points of no return — where a defect can revoke a customer's production credential.
- Define the least-privilege permission model customers grant us in Entra ID, AWS, and Password Safe, feature by feature. Own how it is verified live and explained in the product, and the setup assets (scripts, templates) that grant exactly that and no more.
- Lead the path from prototype to production: service-to-service authentication, tenant isolation, FIPS-compliant builds, and promotion through commercial and government environments.
- Design how our own services obtain identities and secrets across AWS accounts, regions, and environments — least privilege, workload identity, no long-lived keys.
- Partner with product, platform, data, and security leaders to align technical strategy with the roadmap; make the build/buy and architectural trade-off calls.
- Raise how the team builds: design reviews, testing against real dependencies and live test tenants, and the conventions and guardrails for AI-assisted development.
- Mentor staff and senior engineers and grow technical leadership on the team.
What You’ll Bring
- Deep expertise architecting and operating large-scale, multi-tenant, distributed cloud services, with a track record of owning architecture across multiple teams or an entire domain.
- Expert in C#/.NET, plus working proficiency in Python — our Temporal workers and every activity that touches a credential are Python. (Equivalent depth in another typed backend language is fine if you can lead a .NET codebase.)
- Production experience with durable or long-running workflow orchestration (e.g., Temporal, AWS Step Functions, Durable Functions) and event-driven systems (e.g., Kafka) — idempotency, retries, compensation, and workflow versioning.
- Hands-on experience building or operating systems that create, rotate, or revoke credentials — cloud access keys, service principals and app registrations, certificates, or vault-held secrets — and a sound instinct for blast radius.
- PAM or vault platform integration experience: managed accounts, rotation plugins, functional accounts. BeyondTrust Password Safe a plus.
- AWS at design level: you have designed how services obtain identity and secrets in production across multiple accounts and environments — least-privilege IAM, workload identity (e.g., IRSA or OIDC federation) instead of long-lived keys, Secrets Manager and KMS, and infrastructure as code (Terraform/Terragrunt).
- Azure at working level: Microsoft Entra ID app registrations and service principals, Microsoft Graph permissions and admin consent, managed identities, and Key Vault.
- Experience defining and versioning API and schema contracts (OpenAPI, protobuf) consumed by multiple teams.
- Production familiarity with Kubernetes (EKS preferred) and GitOps delivery.
- Excellent communication; able to influence technical direction across teams and with leadership.
- Comfortable working in an AI-assisted codebase and setting the standard for how AI-generated code is reviewed — especially changes that touch permissions.
Nice To Have
- Deep identity-security domain experience: IAM, NHI and secrets management, OAuth/OIDC, privileged access management.
- Delivery in regulated or government environments (FedRAMP, FIPS 140, AWS GovCloud).
- Additional identity models (GCP service accounts, GitHub Apps and tokens, Okta).
- Lakehouse / Databricks pipelines, including row-level security and governed data access; graph data modeling.
- Service mesh and mTLS.
- Daily hands-on practice with agentic coding tools such as Claude Code.
- Taking a module from 0 to 1 at enterprise scale.
Who You Are
- A technical authority who takes ownership of the hardest problems and delivers scalable, safe solutions.
- A force multiplier who elevates the engineers and teams around you.
- Someone who balances technical excellence with pragmatic decision-making, ensuring security without unnecessary complexity.
- A strong communicator and influencer across technical and business audiences.
Better Together
Diversity. Inclusion. They’re more than just words for us. They are the guiding values of how we build our teams, cultivate leaders, and create a culture where people feel connected.
We take care of our employees so they can take care of our customers. Customers who come from all walks of life just like us. We hire incredible people from diverse backgrounds because when we are different together, we are stronger together.
About Us
BeyondTrust is the global identity security leader protecting Paths to Privilege™. Our identity-centric approach goes beyond securing privileges and access, empowering organizations with the most effective solution to manage the entire identity attack surface and neutralize threats, whether from external attacks or insiders.
BeyondTrust is leading the charge in transforming identity security to prevent breaches and limit the blast radius of attacks, while creating a superior customer experience and operational efficiencies. We are trusted by 20,000 customers, including 75 of the Fortune 100, and our global ecosystem of partners.
Learn more at www.beyondtrust.com.
#LI-DN1
