• Design, build and run features in the User Management API: tenant and landscape lifecycle, user
and group administration, role-based access control, service accounts and client credentials, and
audit and security support tooling.
• Own the integrations with Okta and Microsoft Entra ID. That includes provisioning, lifecycle sync,
event handling and app-registration automation, with failure modes that are safe and recoverable.
• Maintain the API's authentication model and the authorization rules behind it.
• Change and version the gRPC and REST contracts carefully, and coordinate SDK releases so the
products that consume them don't break.
• Secret management using Azure Services.
• Continue to support multi-tenancy, auditing and maintaining data integrity across tenants.
• Write tests that matter: NUnit and Moq unit tests, integration tests and automated smoke suites
focused on authentication flows, permission boundaries and tenant isolation.
• Work with frontend engineers on the sign-in and admin experience, and with product teams who
use the platform through the SDK.
• Take part in on-call and incident response for a service every PowerPlan cloud customer depends
on.
• 5+ years building production back-end services in C# / .NET (ASP.NET Core Web API, dependency
injection, async patterns).
• Hands-on identity and access management experience. You've built or run real systems with:
- OAuth 2.0 and OpenID Connect: authorization code with PKCE, client credentials, token validation and refresh
- WTs: claims design, validating against several issuers and audiences, signing keys and key rotation
- Multi-tenant user, role and permission models (RBAC), including tenant isolation
- User lifecycle: invitation, activation, deactivation, deprovisioning and sync with an external identity provider
• Production experience with at least one enterprise identity provider: Okta (strongly
preferred), Microsoft Entra ID / Azure AD, Auth0 or Ping or other.
• Solid relational database skills with SQL Server and EF Core, including migrations and query
performance.
• Experience designing and versioning APIs that other teams depend on (REST, and ideally gRPC /
Protocol Buffers).
• Security instincts: you know the OWASP Top 10, handle secrets carefully, write auditable code,
and default to least privilege.
Our stack
.NET 10 · ASP.NET Core · gRPC / Protobuf · EF Core · SQL Server · Okta · Microsoft Entra ID / Graph · Azure
Key Vault & App Configuration · Autofac · NLog · NUnit / Moq · Angular / Nx · Azure DevOps
Nice to have
• Okta Management API / SDK, Okta event hooks and inline hooks, or Okta Identity Engine (IDX)
• Microsoft Graph, particularly app registrations, service principals and credential management
• SAML 2.0, SCIM provisioning, or enterprise SSO federation with customer identity providers
• Azure: Key Vault, App Configuration, Managed Identity, Data Protection
• Publishing and versioning internal NuGet packages (GitVersion, Conventional Commits)
• Angular or another modern front-end framework, enough to work with the portal team on sign-in
and admin screens
• Experience in regulated industries (utilities, finance, tax) where audit trails and access reviews
matter
• Comfort with AI-assisted development tools as part of daily work
What success looks like
• First 90 days: you can run the full identity stack locally, explain how a user gets from the portal
through sign-in to an authorized API call, and you've shipped a change that crosses at least two
services.
• First year: you own a major part of the platform (for example tenant and landscape provisioning,
or the Okta and Entra integration layer), you've raised its test coverage and observability, and other
product teams come to you on identity questions.