Staff Security Software Engineer, IAM

The role

You will define and drive the technical strategy for identity and access. You will design and build complex identity systems and lead cross-functional initiatives for authentication and authorization.

What you will do

• Define Harvey's multi-year technical strategy for identity, authentication, authorization, and privileged access.
• Design and build complex identity systems from greenfield.
• Lead the architecture and execution of cross-functional initiatives to right-size access at scale.
• Extend the identity model to non-human and agentic identities.
• Serve as the technical authority for identity and access architecture.
• Guide major design reviews, investment decisions, and long-term roadmaps.

Required qualifications

• 10+ years experience building and operating production software.
• Deep expertise in several identity and access engineering domains such as authentication, federation, authorization, entitlement modeling, or privileged access.
• Fluency with AI using AI-assisted development tools and designing agentic workflows.
• Experience designing identity or authorization platforms, libraries, or abstractions used by other engineering teams.
• Experience delivering foundational systems that achieve meaningful adoption and improve organizational or customer outcomes.
• Experience with cloud infrastructure, such as Azure, Google Cloud Platform, or Amazon Web Services, and modern distributed-system patterns.
• Strong communication skills and the ability to create alignment across technical and non-technical stakeholders.

Nice to have

• Experience with System for Cross-domain Identity Management (SCIM), OpenID Connect (OIDC), Security Assertion Markup Language (SAML), policy engines such as Open Policy Agent (OPA) or Cedar, Zanzibar-
• Experience with identity governance and administration (IGA) or privileged access management (PAM) platforms, and with automating joiner, mover, and leaver workflows.
• Experience building identity platforms or programs at a hyper-growth startup.
• Experience with regulated environments such as FedRAMP, including phishing-resistant authentication and authenticator assurance requirements.

About the company

Harvey is transforming how legal and professional services operate by combining frontier agentic AI, an enterprise-grade platform, and deep domain expertise.