Senior Backend Engineer - Identity & Access (OAuth, OIDC, Okta)

About the role

A large US-based client in the aesthetics and pharmaceutical sector is hiring a Senior Backend Engineer for its Core Platform team, which builds shared services such as enterprise identity and access management, API routing, client SDKs, audit trails and developer tooling. The role is 100% remote, full-time, with overlap with US business hours, and is a long-term independent contract with no specified termination period. Candidates must be based in Costa Rica.

Key responsibilities

• Design, build and maintain authentication and authorization for end users, internal services and third-party integrations.
• Integrate with enterprise identity providers such as Okta, including federation (SAML, OpenID Connect), multifactor authentication, application configuration and user-lifecycle migrations.
• Implement OAuth 2.0 flows, token issuance and validation, service-to-service authentication and delegated or partner access.
• Design role and permission models (RBAC, fine-grained and multi-tenant authorization) and enforce them across services.
• Build and maintain backend services, APIs, client SDKs and middleware used by other teams.
• Plan and execute safe migrations of users, applications and legacy authentication flows, with backward compatibility, feature flags, validation and rollback plans.
• Translate security, privacy and compliance requirements into designs and code, and review designs and pull requests with a security lens.
• Monitor, troubleshoot and improve reliability using logs, metrics, traces and alerts, and take part in the on-call rotation.
• Write technical documents (designs, API contracts, runbooks) and explain security concepts to technical and non-technical audiences.

Required profile

• 8+ years of software engineering with substantial backend responsibility.
• Production experience building and running backend services and APIs (REST, GraphQL or gRPC) in a modern language such as TypeScript/Node.js, Java, C#/.NET, Go, Python or Kotlin.
• Experience with relational databases, cloud-hosted distributed systems, automated testing, code reviews and CI/CD.
• Strong debugging, system-design and written communication skills, with clear spoken English.
• Bonus: experience leading technical execution, mentoring engineers and coordinating with Security, infrastructure, product and vendor teams.

Required skills

• Hands-on experience with authentication and authorization in production.
• OAuth 2.0 and OpenID Connect (authorization code with PKCE, client credentials, token exchange or on-behalf-of).
• SAML 2.0 and federation between identity providers and applications.
• Integration with an enterprise identity provider such as Okta (preferred), Auth0, Microsoft Entra ID, Ping or Keycloak.
• JWT validation, session management, MFA, service accounts and secrets management.
• Role and permission models, delegated access, and awareness of OWASP Top 10 risks and secure coding.
• Nice to have: Okta Identity Engine, Okta APIs, Terraform, PingFederate, SCIM, DPoP, OPA, CISSP or other security certifications.