Senior Engineer

About DrFirst

For 25 years, DrFirst has empowered providers and patients to achieve better health through intelligent medication management. We improve healthcare workflows and help patients start and stay on therapy with end-to-end solutions that enhance prescription access, affordability, and adherence. Our solutions help 100 million patients a year and are used by more than 420,000 prescribers, 71,000 pharmacies, 270 EHRs and health information systems, and over 2,000 hospitals in the U.S. This is a great opportunity to be a part of a successful Healthcare IT company experiencing significant growth. Here you’ll get to work with some of the smartest and most interesting people around, solving unique and complex challenges in healthcare on a scale matched by few companies. If you get excited about stretching yourself in new ways, developing yourself to your fullest potential, and care about working with smart colleagues, we want to talk to you

Position Overview

Every day, tens of thousands of clinicians launch into DrFirst applications to prescribe medications and manage patient care, and every launch flows through the identity platform. This role is the technical anchor for a production IAM platform built on Keycloak. It spans custom SPI development in Java, a major-version migration, standards-based modernization of partner SSO, and the session architecture behind a national e-prescribing network.

This is platform ownership, not an integration seat. You will operate a living system with real scale, real incidents, and real migration deadlines, and you will hold the mandate to modernize it. You will regularly be the person who can read a JVM GC log, a Postgres session table, and an OAuth spec in the same afternoon. If you have wanted to be the engineer who both writes the custom grant provider and decides whether it should exist, this is that seat.

What you will work on

• Keycloak Extension (SPI) Development: Design, build, and refactor custom Keycloak SPIs in Java, including authenticators, grant-type providers, mappers, and just-in-time provisioning. EMR SSO integrations run on custom extension code you will own end to end.
• Standards-Based Auth Modernization: Lead the migration of proprietary partner SSO flows to modern OAuth 2.0 and OIDC patterns, including JWT Bearer grants (RFC 7523), Token Exchange (RFC 8693), authorization code plus PKCE, and BFF architectures for web clients, making and defending the architectural calls.
• Major Version Migration: Drive the Keycloak major-version upgrade, including the shift from external Infinispan session caching with JDBC persistence to persistent user sessions, and validate every downstream integration against the new version.
• Session and Token Architecture: Own the session lifecycle model across SSO, client, and offline sessions, including idle and max semantics, token lifespans, and refresh rotation, and design per-client TTL policies that balance clinical workflow UX against security posture.
• Production Ownership and Incident Response: Serve as the deep-diagnosis engineer for JVM tuning (heap, Metaspace, GC), Infinispan cluster behavior, PostgreSQL session-store forensics, and log-driven root-cause analysis on live authentication traffic.
• Federation and Platform Hygiene: Design integrations with external identity systems (OIDC, SAML, cloud identity platforms), including JWKS trust, key rotation, and audience and issuer validation, and treat realm and client configuration as version-controlled, least-privilege, auditable code.
• Technical Mentorship: Raise the bar on OAuth and OIDC fluency and secure coding across the team, and represent the platform technical position to application teams and leadership.

Qualifications

Required

• 6+ years of professional software engineering with strong, production-grade Java, including significant focus on Identity and Access Management.
• Expert Keycloak experience beyond the admin console, with hands-on SPI and extension development, realm and client architecture for multi-tenant platforms, and running Keycloak (Quarkus) in production on Kubernetes.
• Deep OAuth 2.0 and OIDC fluency, including authorization code plus PKCE, client credentials, Token Exchange (RFC 8693), JWT Bearer (RFC 7523), and refresh rotation. Working knowledge of SAML 2.0.
• Session and token architecture depth: stateful SSO sessions versus stateless JWT validation, online versus offline sessions, idle and max semantics, and JWKS validation and key rotation, with the judgment to choose per use case.
• Hands-on distributed caching and state with Infinispan or comparable technology, including clustering, persistence, expiration, and the failure modes of distributed session state.
• Production operations skill: JVM performance analysis (GC logs, hea