Staff Security Software Engineer, IAM

San Francisco · USD 231,000-340,000 · 10+ years experience · Full-time · Hybrid · Posted Oct 1, 2026

At a glance

As a Staff Software Engineer on the Security Engineering team, you will be a founding member defining and driving the technical strategy for identity and access at Harvey.
The role involves building systems for customer authentication and internal access management, while exploring AI-powered access management solutions.
You will operate at the boundary of security, infrastructure, and product engineering to turn technical requirements into durable identity platforms.

Define Harvey's multi-year technical strategy for identity, authentication, authorization, and privileged access.
Design and build complex identity systems from greenfield, including coding, instrumentation, and production ownership.
Lead the architecture and execution of cross-functional initiatives to right-size access at scale.
Extend the identity model to non-human and agentic identities to ensure they are authenticated, scoped, and auditable.
Serve as the technical authority for identity and access architecture.
Guide major design reviews, investment decisions, and long-term roadmaps.

10+ years experience building and operating production software with impact across multiple teams or domains.
Deep expertise in identity and access engineering domains such as authentication, federation, authorization, entitlement modeling, or privileged access.
Fluency with AI-assisted development tools and designing agentic workflows.
Experience designing identity or authorization platforms, libraries, or abstractions used by other engineering teams.
Experience delivering foundational systems that achieve meaningful adoption.
Experience with cloud infrastructure such as Azure, GCP, or AWS and modern distributed-system patterns.
Strong communication skills and ability to create alignment across stakeholders.

Experience with SCIM, OIDC, SAML, or hardware-backed credentials.
Experience with policy engines such as Open Policy Agent (OPA) or Cedar.
Experience with Zanzibar-style authorization systems.
Experience with identity governance and administration (IGA) or privileged access management (PAM) platforms.
Experience automating joiner, mover, and leaver workflows.
Experience building identity platforms or programs at a hyper-growth startup.
Experience with regulated environments such as FedRAMP.