--- title: 'Sr Staff Software Development Engineer at BeyondTrust' canonical: 'https://feeny.ai/job/sr-staff-software-development-engineer-beyondtrust-canada-united-states-73xfenm09r3a' type: 'job' last_seen: '2026-10-16' --- # Sr Staff Software Development Engineer at BeyondTrust - **Company:** BeyondTrust - **Location:** Canada / United States - **Work type:** remote - **Posted:** 2026-07-24 - **Last confirmed live:** 2026-10-16 - **Apply:** https://job-boards.greenhouse.io/beyondtrust/jobs/7931033 ## Job description Diversity. Inclusion. They’re more than just words for us. They are the guiding values of how we build our teams, cultivate leaders, and create a culture where people feel connected. We take care of our employees so they can take care of our customers. Customers who come from all walks of life just like us. We hire incredible people from diverse backgrounds because when we are different together, we are stronger together. ## The Role BeyondTrust is seeking a Senior Staff Software Development Engineer to set the technical direction for NHI Governance. NHI Governance is the Pathfinder Insights module that discovers, assesses, and remediates non-human identities — service principals, IAM users, access keys and secrets, workload identities, and AI agents — across Microsoft Entra ID, AWS, and on-premise environments. The system spans .NET 10 services over PostgreSQL; an inventory pipeline fed from governed Databricks lakehouse views; durable Temporal workflows (Python workers, a .NET gateway, protobuf contracts) that onboard, rotate, reduce access for, and decommission live customer credentials, with custody in BeyondTrust Password Safe and storage adapters for AWS Secrets Manager, Azure Key Vault, and HashiCorp Vault; and Angular micro-frontends in the Insights console. It ships through GitOps to Amazon EKS in commercial and government environments. As one of the most senior engineers on the team, you will own the architecture across these pieces and the contracts that hold them together, lead the system from prototype to hardened production, and act as a force multiplier for a team that works in an AI-assisted, agent-native way. ## What You’ll Do - Own end-to-end architecture for NHI Governance across its services, the workflow layer it shares with the platform team, and the data lineage from the Insights lakehouse — and decide where each boundary lives. - Design the source and vault plug-in seams (today Entra and AWS are bespoke), so a new identity source or vault becomes a repeatable, conformance-tested addition rather than a rewrite. - Define and evolve the contracts other teams build on: service APIs and protobuf workflow schemas with breaking-change gates. - Set the safety model for credential-lifecycle automation — rotation, decommissioning, access reduction, approvals, compensation, and points of no return — where a defect can revoke a customer's production credential. - Define the least-privilege permission model customers grant us in Entra ID, AWS, and Password Safe, feature by feature. Own how it is verified live and explained in the product, and the setup assets (scripts, templates) that grant exactly that and no more. - Lead the path from prototype to production: service-to-service authentication, tenant isolation, FIPS-compliant builds, and promotion through commercial and government environments. - Design how our own services obtain identities and secrets across AWS accounts, regions, and environments — least privilege, workload identity, no long-lived keys. - Partner with product, platform, data, and security leaders to align technical strategy with the roadmap; make the build/buy and architectural trade-off calls. - Raise how the team builds: design reviews, testing against real dependencies and live test tenants, and the conventions and guardrails for AI-assisted development. - Mentor staff and senior engineers and grow technical leadership on the team. ## What You’ll Bring - Deep expertise architecting and operating large-scale, multi-tenant, distributed cloud services, with a track record of owning architecture across multiple teams or an entire domain. - Expert in C#/.NET, plus working proficiency in Python — our Temporal workers and every activity that touches a credential are Python. (Equivalent depth in another typed backend language is fine if you can lead a .NET codebase.) - Production experience with durable or long-running workflow orchestration (e.g., Temporal, AWS Step Functions, Durable Functions) and event-driven systems (e.g., Kafka) — idempotency, retries, compensation, and workflow versioning. - Hands-on experience building or operating systems that create, rotate, or revoke credentials — cloud access keys, service principals and app registrations, certificates, or vault-held secrets — and a sound instinct for blast radius. - PAM or vault platform integration experience: managed accounts, rotation plugins, functional accounts. BeyondTrust Password Safe a plus. - AWS at design level: you have designed how services obtain identity and secrets in production across multiple accounts and environments — least-privilege IAM, workload identity (e.g., IRSA or OIDC federation) instead of long-lived keys, Secrets Manager and KMS, and infrastructure as code (Terraform/Terragrunt). - Azure at working level: Microsoft Entra ID app registrations and service principals, Microsoft Graph permissions and admin consent, managed identities, and Key Vault. - Experience defining and versioning API and schema contracts (OpenAPI, protobuf) consumed by multiple teams. - Production familiarity with Kubernetes (EKS preferred) and GitOps delivery. - Excellent communication; able to influence technical direction across teams and with leadership. - Comfortable working in an AI-assisted codebase and setting the standard for how AI-generated code is reviewed — especially changes that touch permissions. ## Nice To Have - Deep identity-security domain experience: IAM, NHI and secrets management, OAuth/OIDC, privileged access management. - Delivery in regulated or government environments (FedRAMP, FIPS 140, AWS GovCloud). - Additional identity models (GCP service accounts, GitHub Apps and tokens, Okta). - Lakehouse / Databricks pipelines, including row-level security and governed data access; graph data modeling. - Service mesh and mTLS. - Daily hands-on practice with agentic coding tools such as Claude Code. - Taking a module from 0 to 1 at enterprise scale. ## Who You Are - A technical authority who takes ownership of the hardest problems and delivers scalable, safe solutions. - A force multiplier who elevates the engineers and teams around you. - Someone who balances technical excellence with pragmatic decision-making, ensuring security without unnecessary complexity. - A strong communicator and influencer across technical and business audiences. Better Together Diversity. Inclusion. They’re more than just words for us. They are the guiding values of how we build our teams, cultivate leaders, and create a culture where people feel connected. We take care of our employees so they can take care of our customers. Customers who come from all walks of life just like us. We hire incredible people from diverse backgrounds because when we are different together, we are stronger together. ## About Us BeyondTrust is the global identity security leader protecting Paths to Privilege™. Our identity-centric approach goes beyond securing privileges and access, empowering organizations with the most effective solution to manage the entire identity attack surface and neutralize threats, whether from external attacks or insiders. BeyondTrust is leading the charge in transforming identity security to prevent breaches and limit the blast radius of attacks, while creating a superior customer experience and operational efficiencies. We are trusted by 20,000 customers, including 75 of the Fortune 100, and our global ecosystem of partners. Learn more at [www.beyondtrust.com](http://www.beyondtrust.com/). ## #LI-DN1 ## About BeyondTrust ## Company Overview - **One-liner**: BeyondTrust provides a unified identity and access security platform that protects identities, remediates threats, and delivers dynamic access across human, non-human, and AI identities. - **Entity Type**: Private (backed by private equity; no public ticker) - **Headquarters**: Not publicly available in provided sources (global company with offices in the US, Canada, UK, Germany, Netherlands, Switzerland, India, Indonesia, Philippines, Australia, and more) - **Founded**: Not publicly available (roots trace to earlier companies; current entity formed through mergers and acquisitions) - **Founders**: Not publicly available ## Core Business - **Primary industry**: Cybersecurity – Identity and Access Security (Privileged Access Management, Identity Threat Detection and Response, Secrets Management, Cloud Infrastructure Entitlement Management, Secure Remote Access) - **Target customers**: B2B, primarily large enterprises (75% of the Fortune 100 are customers), also government, mid-market, and SMBs - **Mission**: "Fight every day to secure identities, intelligently remediate threats, and deliver dynamic access to empower and protect organizations around the world." Vision: "A world where all identities and access are protected from cyber threats." ## Products & Services - **BeyondTrust Pathfinder Platform**: Unified platform that integrates PAM, ITDR, Secrets Management, CIEM, and Secure Remote Access. Enforces least privilege, zero standing privilege, just-in-time access, and discovers hidden privilege paths. - **Endpoint Privilege Management**: Removes local admin rights and enforces least privilege on endpoints. - **Password Safe**: Enterprise password and secrets vault with rotation and just-in-time access. - **Secure Remote Access**: Zero-trust remote support and vendor access (including Remote Support), with session management and credential vaulting. - **Identity Security Insights**: Analytics and reporting on identity risk. - **AI Analysis & AI Chat**: AI-powered threat detection and conversational interface for incident response. - **Entitle**: Cloud infrastructure entitlement management (CIEM) for multi-cloud environments. - **MCP Integration**: Integration with Model Context Protocol for controlling AI agent privileges. ## Market Standing - **Valuation/Market Cap**: Not publicly available (private company) - **Key Metric**: Not disclosed; recognized as a Leader in the Gartner Magic Quadrant for PAM (7 years in a row), Forrester Wave Leader for PIM, KuppingerCole Leader for ITDR, and GigaOm Leader for CIEM. - **Notable Investors/Partners**: Private equity owned (Francisco Partners and others per general knowledge, not explicitly in provided sources). Key partners include ServiceNow (integration with service desk workflows). - **Growth Signals**: 75% of the Fortune 100 are customers; continuously hiring across 45+ open positions globally; named Inc. Best Workplaces 2023, Nova Scotia's Top Employer 2022, Best Workplaces in Tech UK 2022. ## Competitive Advantages - **Unified Pathfinder Platform**: Single platform covering all identity security use cases (human, non-human, AI) rather than disconnected tools. - **True Privilege™ Technology**: Maps actual identity attack paths (lateral movement, shadow access, inherited entitlements) to uncover hidden Paths to Privilege. - **Analyst Validation**: Consistently ranked as a Leader by Gartner, Forrester, KuppingerCole, and GigaOm. - **AI Governance**: First-to-market governance for AI agent identities across multiple cloud and SaaS environments (AWS, Azure, Google, OpenAI, Salesforce, ServiceNow). - **Zero Standing Privilege**: Automates just-in-time access and auto-revokes privileges to reduce attack surface. ## Strategic Focus - **Convergence of Identity Security**: Moving beyond siloed PAM to a connected, privilege-centric identity security strategy. - **AI Identity Governance**: Enforcing privilege controls on rapidly growing AI agents and non-human identities. - **Cloud and OT Expansion**: Protecting identities across cloud, SaaS, and operational technology environments. - **Integrating with Service Management**: Streamlining workflows through integrations with ServiceNow and other IT service management tools. - **Customer Experience**: Maintaining industry-leading customer satisfaction scores through exceptional support and customer success. ## Why Work Here - **Remote-First Culture**: Most roles are fully remote with flexible work arrangements; offices exist in multiple countries. - **Award-Winning Workplace**: Recognized by Inc., Nova Scotia's Top Employer, and Best Workplaces in Tech UK. - **Core Values**: Teamwork, Integrity, Humility, Passion, Accountability, Results. Emphasis on continuous learning and growth, with training resources and career development programs. - **Diversity & Inclusion**: BeyondTrust Resource Groups (BTRGs) for affinity groups, community building, and educational events. - **Transparency**: Monthly all-hands town halls where executives share business priorities and success metrics. - **Community Impact**: BeyondGiving program supports employee-led sponsorships and global fundraising. - **Benefits**: Competitive benefits package (details not fully disclosed but includes development tools). - **Recruitment Authenticity**: The company warns about recruitment fraud, indicating a high focus on candidate safety. ## Sources 1. [beyondtrust.com - Company Overview](https://www.beyondtrust.com/company/overview) 2. [beyondtrust.com - Employee Life](https://www.beyondtrust.com/company/overview/employee-life) 3. [beyondtrust.com - Careers](https://www.beyondtrust.com/company/overview/careers) 4. [beyondtrust.com - Homepage](https://www.beyondtrust.com/) 5. [greenhouse.io - Current Openings](http://job-boards.greenhouse.io/beyondtrust) ## Other roles at BeyondTrust - [Enterprise Account Manager, SLED](https://feeny.ai/job/enterprise-account-manager-sled-beyondtrust-chicago-g9278gcycfgw) — Chicago, IL / Detroit, MI / Columbus, OH / Indianapolis, IN - [Cloud Network Engineer](https://feeny.ai/job/cloud-network-engineer-beyondtrust-united-states-wp633va6s329) — United States - [Staff Software Development Engineer](https://feeny.ai/job/staff-software-development-engineer-beyondtrust-united-states-canada-rn58aghrzc6w) — United States / Canada - [Business Development Representative](https://feeny.ai/job/business-development-representative-beyondtrust-boston-2xf7c8642yez) — Boston, MA - [Manager, FP&A - R&D](https://feeny.ai/job/manager-fp-a-r-d-beyondtrust-united-states-us-east-coast-jz77cv3t3ryk) — United States / US East Coast - [Business Development Representative](https://feeny.ai/job/business-development-representative-beyondtrust-boston-d3bvanvj2asp) — Boston, MA - [Sr Site Reliability Engineer](https://feeny.ai/job/sr-site-reliability-engineer-beyondtrust-united-states-canada-7jfpz904xd8s) — United States / Canada - [Global Benefits Manager - Contract](https://feeny.ai/job/global-benefits-manager-contract-beyondtrust-united-states-mpejqj0e0jh2) — United States - [Sr Software Development Engineer](https://feeny.ai/job/sr-software-development-engineer-beyondtrust-united-states-canada-5w4m21vkf717) — United States / Canada - [Sr Manager, Site Reliability Engineer (FedRAMP / AWS GovCloud)](https://feeny.ai/job/sr-manager-site-reliability-engineer-fedramp-aws-govcloud-beyondtrust-united-1qv2749fa7ty) — United States