Senior Software Engineer Trust

### Role Overview Building for trust is non‑negotiable in our mission of making mental healthcare more accessible and affordable across the US: patients share sensitive information, payers demand demonstrably strong controls, and providers depend on reliable, secure infrastructure. Trust Foundations is responsible for instilling confidence in our products by safeguarding our user’s data. We achieve this by developing out-of-the-box identity, access, and secure-data platforms for other engineering teams to utilize. ### Responsibilities - Design, build, and operate core trust primitives - authentication providers, authorization engines, data governance, stratified encrypted data stores, and tamper‑evident audits. - Embed security & privacy by design - Partner with Legal/Compliance to translate regulatory language into concrete engineering controls. - Scale our identity rails - Design and evolve multi‑tenant authentication & authorization services that handle millions of sessions daily with high availability expectations. - Deliver scalable, secure platform foundations - Design and build 0-1 shared services, implement consistent access control patterns that enable product teams to move quickly while ensuring security-by-default (least‑privilege access, encryption in transit and at rest, audit hooks). - Turn ambiguous requirements into incremental delivery plans - Lead architecture reviews; break large problems into testable milestones; and make pragmatic build‑vs‑buy decisions in a regulated domain. - Champion operational excellence - Instrument services, tune alerting, own on‑call runbooks, and drive post‑incident hardening. - Elevate engineering culture - Mentor teammates, document patterns, and help recruit the next generation of Headway engineers. ### Requirements - Security Mindset: Passionate about cybersecurity and protecting access to sensitive user data. - Cross functional Collaboration: Demonstrated effective collaboration working with product, infosec and compliance teams. - A track record of mentoring engineers, elevating design quality, and improving engineering processes. - Secure Architecture: Ability to think of security platforms as an enabler of secure product development. - Dealing with ambiguity: Comfortable working with and bringing clarity to ambiguous requirements. - 3+ years of experience working in data governance and access control systems (RBAC/ABAC) compliant with HIPAA, HITRUST, SOC2 etc. - 3+ years of experience working with third party IdPs and expertise with OAuth 2.0 / OIDC standards. - 3+ years of experience with Python, TypeScript and AWS.