Staff Software Engineer

2025 Black Book Awards: Ranked #1 EHR in 11 Specialties

Florida Venture Forum: Venture-Backed Company of the Year

We are growing fast, thinking big, and we are just getting started.

Ready to modernize medicine with us?

Job Description Summary:

About the Role

We are seeking a Staff Software Engineer to lead the technical vision, architecture, and deployment of our enterprise Identity & Access Management (IAM) platform. In this role, you will own the evolution of our core identity services, driving deep customizations in Keycloak, automating zero-downtime infrastructure deployments, and scaling our authentication and authorization footprint.

As a Staff Engineer, you will bridge the gap between core Java backend engineering, modern IAM protocols, cloud-native GitOps workflows, and modern AI-driven software engineering practices to accelerate development and boost team productivity.

In this role, you will lead the technical direction for identity systems that secure millions of users, handle high-throughput authentication, and enforce fine-grained access control across our entire ecosystem.

As a technical leader on the team, you will balance deep hands-on architectural design with cross-functional mentorship, working closely with Security, Infrastructure, and Product teams.

What You’ll Do

Core IAM Architecture: Drive the roadmap and architecture for our centralized authentication and authorization platforms, leveraging Keycloak as a core engine.

Custom Development: Design, build, and maintain custom SPI extensions, providers, and high-performance services in Java.

Identity Lifecycle & Provisioning: Architect robust SCIM integrations for user provisioning and streamline audit logging and security monitoring integrations with SIEM systems.

GitOps & Infrastructure as Code: Lead the automation of our identity infrastructure using Terraform, Ansible, Helm, and ArgoCD to maintain secure, reproducible, and self-healing environments.

Security & Protocol Leadership: Implement and harden OAuth 2.0, OIDC, SAML, and fine-grained access control across service-to-service and user-facing architectures.

AI-Assisted Engineering: Leverage AI developer tools (e.g., GitHub Copilot, Cursor, LLM-driven coding assistants) to accelerate development workflows, automate unit test generation, optimize Keycloak extension code, and establish AI best practices across the team.

Hands-On Development: Work on critical initiatives leading them to completion.

Technical Ownership & Mentorship: Lead RFCs, conduct architecture reviews, and mentor senior engineers across the engineering organization.

What We’re Looking For

Experience: 8+ years of software engineering experience, with demonstrated technical leadership at a Staff or Principal level in IAM, Security, or Core Infrastructure.

Keycloak & Java Expertise: Deep hands-on experience extending, scaling, and operating Keycloak in production, alongside mastery of Java and JVM internals.

AI-Driven Software Development: Proven experience incorporating AI tools and LLM workflows into daily software engineering (e.g., automated code generation, AI-assisted refactoring, test suite generation, and prompt engineering for development tasks).

IAM Standards: Deep expertise in OAuth 2.0, OIDC, SAML, and SCIM for identity lifecycle management.

Cloud-Native IaC & CI/CD: Strong experience building automated deployment pipelines and managing infrastructure via code.

Security Operations: Hands-on experience integrating application logs, telemetry, and security events into SIEM solutions.

Nice-to-Haves / Strong Pluses

Container & GitOps Tooling: Hands-on experience with ArgoCD, Helm, Ansible, and Terraform for automated Kubernetes and infrastructure management.

Experience integrating AI capabilities or anomaly detection models into identity workflows and threat detection.

Experience with zero-downtime Keycloak cluster upgrades and multi-region deployments.

Familiarity with service-to-service authentication (mTLS) and fine-grained authorization frameworks.

ModMed Benefits Highlight: At ModMed, we believe it’s important to offer a competitive benefits package designed to meet the diverse needs of our growing workforce. Eligible Modernizers can enroll in a wide range of benefits:

United States

• Comprehensive medical, dental, and vision benefits, including a company Health Savings Account contribution,
• 401(k): ModMed provides a matching contribution each payday of 50% of your contribution deferred on up to 6% of your compensation. After one year of employment with ModMed, 100% of any matching contribution you receive is yours to keep.
• Generous Paid Time Off and Paid Parental Leave programs,
• Company paid Life and Disability benefits, Flexible Spending Account, and Employee Assistance Programs,
• Company-sponsored Business Resource & Special Interest Groups that provide engaged and supportive communities within ModMed,
• Professional development opportunities, including tuition reimbursement programs and unlimited access to LinkedIn Learning,
• Global presence and in-person collaboration opportunities; dog-friendly HQ (US), Hybrid office-based roles and remote availability for some roles,
• Weekly catered breakfast and lunch, treadmill workstations, Zen, and wellness rooms within our BRIC headquarters.

PHISHING SCAM WARNING: ModMed is among several companies recently made aware of a phishing scam involving imposters posing as hiring managers recruiting via email, text and social media. The imposters are creating misleading email accounts, conducting remote "interviews," and making fake job offers in order to collect personal and financial information from unsuspecting individuals. Please be aware that no job offers will be made from ModMed without a formal interview process, and valid communications from our hiring team will come from our employees with a ModMed email address (first.lastname@modmed.com). Please check senders’ email addresses carefully. Additionally, ModMed will not ask you to purchase equipment or supplies as part of your onboarding process. If you are receiving communications as described above, please report them to the FTC website.