Senior Staff Software Engineer (Identity & Access Management)

• Join us! GoFundMe is searching for a Senior Staff Software Engineer for Identity Platform to serve as the technical leader driving the architecture, scalability, and reliability of our identity platform, the foundational layer that every product team, enterprise customer, and internal service builds on
• Your work will directly shape how millions of people trust and interact with GoFundMe, and how engineering teams across the company build identity-dependent features with confidence
• As a key technical leader, you will have the opportunity to define how consumer and enterprise identity converge into a unified, secure platform, driving impact for the company, the engineering organization, and the people we serve
• Join us if you are excited to own a meaningful systems problem end-to-end while making a direct impact on trust, personalization, and the causes that matter most
• Define and evolve the end-to-end IAM architecture spanning authentication, authorization, session management, and token lifecycle across consumer and enterprise contexts. Establish the trust boundaries, integration contracts, and platform primitives that make the secure path the default for every team consuming identity services
• Own the enterprise identity onboarding experience for our nonprofit customers: repeatable, self-service SSO, SCIM provisioning, and multi-tenant trust patterns that scale without bespoke integration per partner
• Architect federation and provisioning patterns (OIDC, SAML 2.0, SCIM) that hold up across a wide range of enterprise IdP configurations, from large institutions to small grassroots organizations
• Make principled build vs. integrate decisions across vendor platforms (Descope, Auth0, Okta) and in-house systems, owning the tradeoffs, migration paths, and long-term cost of change
• Design and operate MFA orchestration and step-up authentication flows, integrating risk signals from the Consumer Identity and Risk Signals engineer to make adaptive, confident auth decisions without adding unnecessary friction for the legitimate majority
• Own the consumer identity platform, including Descope CIAM, session management, passwordless authentication, and social login, balancing security against funnel conversion with a lean toward the enterprise and Pro surfaces where IAM complexity is highest
• Establish policy enforcement architecture (PEP and PAP) and the contracts by which authorization decisions are reliably enforced at runtime across consumer and enterprise surfaces
• Own the IAM technical roadmap, prioritizing initiatives based on user impact, enterprise requirements, compliance obligations, and technical feasibility
• Partner with Consumer Identity and Risk Signals, Payments, Security, and Integrity as the IAM platform interface for the systems that depend on it
• Mentor engineers across the Identity team and the broader Platform Tribe, raising the bar on system design, security thinking, and operational rigor

Benefits

• $600 annual fitness and wellness reimbursement
• Wide range of health insurance options, including medical, dental, and vision (GoFundMe covers 100% of employee premiums, and 80% of spouse and dependents)
• Weekly massages
• Standing desks
• Fully-stocked kitchens & daily lunches
• Team off-sites & monthly social events
• Many of our offices are dog friendly
• Enhanced parental leaves
• 10 paid holidays, 17 days of accrued vacation per year, unlimited sick time & three volunteer days
• Caltrain GoPasses for our Bay Area commuters
• $50/month for employees commuting to and from work (public transit and/or parking)
• Quarterly volunteer events in each office to give back to our local communities
• “Gives Back” program, where employees nominate fundraisers weekly for donations from GoFundMe
• 401(k) retirement plan with company matching
• Access to learning tools and resources, including a subscription to Udemy, guest speakers, and internal brown bag sessions

• 8+ years of software engineering experience, with significant time at senior, staff, or principal levels working on platform or infrastructure systems
• Strong security instincts: you threat-model as you design, understand credential risk and account takeover patterns, and build systems where the secure path is the easy path
• Strong observability and reliability skills: experience with monitoring, alerting, and incident response for mission-critical identity infrastructure
• Demonstrated ability to lead projects from ambiguity through delivery, balancing technical depth with business context and keeping teams aligned across organizational boundaries
• Deep, hands-on expertise with identity protocols and standards: OAuth 2.x, OpenID Connect, SAML 2.0, and SCIM
• Experience architecting systems using federation standards, session/token management patterns, and well-defined trust boundaries, with an eye toward minimizing the cost of future change
• Proficiency in relational database design and data modeling for identity systems, including schema evolution strategies for high-availability environments
• Track record of designing and shipping identity or auth platforms that other engineering teams depend on in production
• Hands-on experience with commercial identity platforms (Descope, Auth0/Okta, Ping, or comparable) in production, including migration between providers
• Experience spanning both enterprise and consumer identity contexts, such as at fintech, SaaS, payments, or identity-forward companies
• Familiarity with advanced authorization models: RBAC, ABAC, ReBAC, or policy engines such as OPA/Cedar
• Experience with compliance and audit requirements relevant to identity systems (SOC 2, PCI DSS, GDPR, CCPA) and data residency considerations
• Practical experience deploying and operating identity services on cloud infrastructure (AWS, GCP, or Azure) at scale
• Contributions to identity standards bodies, open-source identity projects, or published thought leadership in the IAM space