Note: The job is a remote job and is open to candidates in USA. DrFirst is a healthcare IT company that provides intelligent medication management and healthcare workflow solutions for providers and patients. The Senior Engineer will own and modernize a production IAM platform built on Keycloak, developing Java extensions, leading OAuth/OIDC modernization and a major-version migration, and managing session architecture, integrations, production operations, and incident response.
Responsibilities
- Design, build, and refactor custom Keycloak SPIs in Java, including authenticators, grant-type providers, mappers, and just-in-time provisioning. EMR SSO integrations run on custom extension code you will own end to end
- Lead the migration of proprietary partner SSO flows to modern OAuth 2.0 and OIDC patterns, including JWT Bearer grants (RFC 7523), Token Exchange (RFC 8693), authorization code plus PKCE, and BFF architectures for web clients, making and defending the architectural calls
- Drive the Keycloak major-version upgrade, including the shift from external Infinispan session caching with JDBC persistence to persistent user sessions, and validate every downstream integration against the new version
- Own the session lifecycle model across SSO, client, and offline sessions, including idle and max semantics, token lifespans, and refresh rotation, and design per-client TTL policies that balance clinical workflow UX against security posture
- Serve as the deep-diagnosis engineer for JVM tuning (heap, Metaspace, GC), Infinispan cluster behavior, PostgreSQL session-store forensics, and log-driven root-cause analysis on live authentication traffic
- Design integrations with external identity systems (OIDC, SAML, cloud identity platforms), including JWKS trust, key rotation, and audience and issuer validation, and treat realm and client configuration as version-controlled, least-privilege, auditable code
- Raise the bar on OAuth and OIDC fluency and secure coding across the team, and represent the platform technical position to application teams and leadership
Skills
- * 6+ years of professional software engineering with strong, production-grade Java, including significant focus on Identity and Access Management
- * Expert Keycloak experience beyond the admin console, with hands-on SPI and extension development, realm and client architecture for multi-tenant platforms, and running Keycloak (Quarkus) in production on Kubernetes
- * Deep OAuth 2.0 and OIDC fluency, including authorization code plus PKCE, client credentials, Token Exchange (RFC 8693), JWT Bearer (RFC 7523), and refresh rotation. Working knowledge of SAML 2.0
- * Session and token architecture depth: stateful SSO sessions versus stateless JWT validation, online versus offline sessions, idle and max semantics, and JWKS validation and key rotation, with the judgment to choose per use case
- * Hands-on distributed caching and state with Infinispan or comparable technology, including clustering, persistence, expiration, and the failure modes of distributed session state
- * Production operations skill: JVM performance analysis (GC logs, heap and Metaspace sizing), correlating structured logs, and SQL-level investigation in PostgreSQL against live systems
- * Security fundamentals and communication: OWASP-aligned secure coding, threat-model thinking around token theft and replay and brute-force protection, MFA and adaptive auth, plus the ability to write a design doc that survives review and translate trade-offs for leadership
- * Prolonged periods of sitting at a desk and working on a computer
- * Ability to operate a computer and other standard office equipment
- * Ability to communicate clearly through video, phone, and written channels in a remote-first environment
- * Occasional travel for team or company meetings may be required
- * Healthcare integration experience, including EMR and EHR launch patterns, SMART on FHIR, or other regulated-industry SSO work
- * Identity brokering experience, including Keycloak brokering and first-login flows, or federating with managed platforms such as Google Identity Platform, Azure AD and Entra, or Okta
- * Observability with Prometheus, Grafana, or ELK, with an eye for authentication anomalies such as login-failure trends, session accumulation, and token-issuance spikes
- * Cloud security certification (AWS Security Specialty or equivalent) and a Master's degree in Computer Science or a related field
Benefits
- Medical, dental, and vision coverage.
- Company-paid life and disability insurance.
- 401(k) retirement plan with company match.
- Flexible and generous paid time off, plus company holidays.
- Remote-first work model with home-office support.
- Parental leave and family support benefits.
- Professional development and continuing-education support.
- Employee wellness and assistance programs.
Company Overview
Company H1B Sponsorship