Job description

WELLTOWER – REIMAGINE REAL ESTATE WITH US At Welltower, we’re transforming how the world thinks about senior living and wellness-focused real estate. As a global leader in residential wellness and healthcare infrastructure, we create vibrant, purpose-driven communities where housing, healthcare, and hospitality converge. Our culture is fast-paced, collaborative, and endlessly ambitious—guided by our mantra: The only easy day was yesterday. We’re looking for bold, independent thinkers who thrive on challenge, embrace complexity, and are driven to deliver long-term value. Every team member is empowered to think like an owner, innovate fearlessly, and lead from where they stand. If you're passionate about outcomes and inspired by the opportunity to shape the future of healthcare infrastructure, we want you on our best-in-class team. ABOUT THE ROLE The Senior Software Engineer on the Auth & Identity team is responsible for designing, implementing, and maintaining the authentication and authorization systems that every Welltower application depends on. This role spans workforce and application identity, access control models, and the services that enforce them. This is a small team. You will work closely with the team lead on architecture, own well-scoped components end-to-end, and have direct input on the design of systems you’ll be running. We are looking for someone who can be an active thinking partner in that process, not just execute a spec. KEY RESPONSIBILITIES • Implement authorization models — relationship-based access control, layered with role and attribute models — and the enforcement points that apply them consistently across services • Design and maintain the APIs and client libraries application teams use to integrate with the platform, including schema governance and a stable client contract • Migrate existing applications onto the platform: partner with application teams, security, and compliance to capture current authorization decisions, backfill data, prove parity, and cut over behind a flag • Establish automated testing for access control logic, including negative and privilege-escalation cases, and replay recorded decisions to prove an application’s current behavior is reproduced before cutover • Design and manage grant and credential lifecycles • Support audit and regulatory requirements, including access reviews and evidence collection (SOC 2 / HIPAA) • Instrument authorization paths for auditability, alerting, and incident response • Create comprehensive documentation for platform architecture, access models, and integration patterns • Integrate with Entra, Okta, and internal identity services, which the platform treats as sources of facts about people rather than sources of authority • Build and maintain authentication services and integrations across OIDC flows TECH STACK • Cloud Platforms: AWS • Decision Engine: SpiceDB • Identity Provider: Entra (primary), Okta • Protocols & Standards: OIDC, gRPC • Programming Languages: TypeScript, SQL, Python • Frameworks & Data: NestJS, Postgres • Version Control: Git • Infrastructure as Code: CDK, Terraform, Pulumi • Monitoring & Observability: Datadog OTHER DUTIES Please note this job description is not designed to cover or contain a comprehensive listing of activities, duties, or responsibilities that are required of this employee for this job. Duties, responsibilities, and activities may change at any time with or without notice. TRAVEL Minimal out-of-area and overnight travel may be expected. MINIMUM REQUIREMENTS • Bachelor’s degree in Computer Science, Information Systems, or related technical field • 5+ years of software engineering experience, including experience building or operating production authentication and authorization systems • Experience designing and implementing access control models in production • Experience with credential and secrets management, including rotation and revocation • Strong proficiency with our tech stack or similar technologies • Experience with CI/CD practices and infrastructure as code • Comfort reasoning about consistency and freshness in a distributed decision store — read-after-write guarantees and revocation latency • Familiarity with Zanzibar-style authorization systems (SpiceDB, AuthZed, or similar) • Excellent problem-solving skills and attention to detail, particularly in systems where errors fail silently • Strong communication skills and the ability to explain access decisions to engineering and non-engineering stakeholders Employment is contingent upon the successful completion of a background check, drug screening, and verification of employment, education, and other credentials relevant to the position. COMPENSATION Salaries may vary by location. The base salary range for this role in New York is $150,000 – $225,000. In addition to base pay, this role is eligible for a highly competitive and lucrative total rewards package, which includes: • Annual bonus opportunity • Lucrative equity awards through our long-term incentive program • A comprehensive benefits suite ABOUT WELLTOWER Welltower® Inc. (NYSE: WELL) an S&P 500 company, is the world’s preeminent residential wellness and healthcare infrastructure company. Our portfolio of 1,500+ Seniors and Wellness Housing communities is positioned at the intersection of housing, healthcare, and hospitality, creating vibrant communities for mature renters and older adults in the United States, United Kingdom, and Canada. We also seek to support physicians in our Outpatient Medical buildings with the critical infrastructure needed to deliver quality care. Our real estate portfolio is unmatched, located in highly attractive micro-markets with stunning built environments. Yet, we are an unusual real estate organization as we view ourselves as a product company in a real estate wrapper driven by relationships and unconventional culture. Through our disciplined approach to capital allocation powered by our data science platform and superior operating results driven by the Welltower Business System, we aspire to deliver long-term compounding of per share growth and returns for our existing investors – our North Star. Welltower is committed to leveraging the talent of a diverse workforce to create great opportunities for our business and our people. EOE/AA. Minority/Female/Sexual Orientation/Gender Identity/Disability/Vet

Requirements

Must-haves

Implement authorization models — relationship-based access control, layered with role and attribute models — and the enforcement points that apply them consistently across services
Design and maintain the APIs and client libraries application teams use to integrate with the platform, including schema governance and a stable client contract
Migrate existing applications onto the platform: partner with application teams, security, and compliance to capture current authorization decisions, backfill data, prove parity, and cut over behind a flag
Establish automated testing for access control logic, including negative and privilege-escalation cases, and replay recorded decisions to prove an application’s current behavior is reproduced before cutover
Design and manage grant and credential lifecycles
Support audit and regulatory requirements, including access reviews and evidence collection (SOC 2 / HIPAA)
Instrument authorization paths for auditability, alerting, and incident response
Create comprehensive documentation for platform architecture, access models, and integration patterns
Integrate with Entra, Okta, and internal identity services, which the platform treats as sources of facts about people rather than sources of authority
Build and maintain authentication services and integrations across OIDC flows
Cloud Platforms: AWS
Decision Engine: SpiceDB
Identity Provider: Entra (primary), Okta
Protocols & Standards: OIDC, gRPC
Programming Languages: TypeScript, SQL, Python
Frameworks & Data: NestJS, Postgres
Version Control: Git
Infrastructure as Code: CDK, Terraform, Pulumi
Monitoring & Observability: Datadog
Minimal out-of-area and overnight travel may be expected.
Bachelor’s degree in Computer Science, Information Systems, or related technical field
5+ years of software engineering experience, including experience building or operating production authentication and authorization systems
Experience designing and implementing access control models in production
Experience with credential and secrets management, including rotation and revocation

Nice-to-haves

None flagged.

Application prep

Use the role’s language and application details while tailoring your materials.

Keywords to mirror

awstypescriptsqlpythonpostgresci/cd

Platform: ukg
Effort: medium

Benefits

Benefits detected in the listing.

Wellness