• Own features from concept to deployment • Design, build, test, and release production-ready software • Refactor and improve existing codebases • Debug and maintain AI-generated applications • Improve scalability, maintainability, and performance • Create technical documentation and design decisions • Collaborate with globally distributed teams

• Deliver cross-cutting engineering work — platform components, refactors, integrations, and high-leverage features — at a pace achievable only through disciplined use of coding agents (Claude Code, Codex, or comparable) and modern agentic engineering practices. • Set the technical standard for the engineering organization. • Define and codify what good agentic engineering looks like at Marathon, including spec-driven development workflows, agent steering documents, custom Skills, MCP server patterns, subagent orchestration, and disciplined context engineering. • Package these as reusable skills, plugins, templates, and internal documentation that other engineers can adopt without reinventing them. • Drive architectural decisions that span Engineering, Data, and Infrastructure. • Partner with the Principal Architect and engineering leadership on systems design problems that cross team boundaries, lead ARB-level reviews, and bring strong fundamentals to API design, distributed systems, event-driven patterns, observability, and security within a HIPAA-regulated environment. • Build internal agents, MCP integrations, and RAG-backed applications where the return on investment is clear. • Apply agent development frameworks pragmatically, with appropriate evaluation, guardrails, and cost discipline. • Influence both what gets built and how it gets built. • Partner directly with engineering leaders, product partners, and internal stakeholders to shape initiative scoping, sequencing, and tradeoff decisions. • Bring product judgment and technical discernment upstream into the question of whether a problem warrants engineering investment — not just downstream into how the work is delivered. • Mentor senior and staff-level engineers across the organization. • Lead pairing sessions, design reviews, and brown-bags. • Grow agentic and AI-native engineering fluency across Engineering, Data, and Infrastructure through hands-on collaboration and visible example. • Operate as a healthcare-aware engineer. Respect PHI handling, BAA requirements, audit trails, clinical safety considerations, and regulated change management, and help teams move efficiently within these requirements.

We're looking for a Software Engineer with Identity and Access Management (IAM) domain experience to support and enhance an enterprise OpenID Connect platform used across a large application ecosystem. This is primarily an application engineering role, not a Kubernetes, DevOps, SRE, or infrastructure engineering position. You'll work on the identity platform itself. Investigating authentication and authorization issues, onboarding applications, maintaining Node.js/TypeScript services, implementing platform enhancements, and troubleshooting complex OAuth2 and OpenID Connect workflows. The ideal candidate has hands-on experience building, supporting, or extending identity platforms and a strong understanding of OAuth2, OpenID Connect, JWTs, claims, scopes, MFA, and identity federation. You should be comfortable reading and modifying application code, debugging production issues, and diagnosing problems across application, data, and infrastructure layers. This role operates with core collaboration hours of **6:00 PM – 12:00 AM IST** to provide overlap with global teams. Outside of core hours, work is flexible and outcome-focused. **What you'll do** - Support day-to-day operation of the OIDC platform - Investigate authentication and authorization issues - Assist with client registrations, configuration changes, and onboarding - Maintain Node.js and TypeScript services - Support MFA integrations and identity federation - Monitor platform health and respond to incidents - Develop automation and operational tooling - Support Elasticsearch and Redis-based services - Participate in on-call rotations

• Own the operational health, reliability, and availability of the OIDC platform • Lead incident investigation and root cause analysis • Diagnose authentication, authorization, MFA, federation, and token-related failures • Develop operational runbooks and platform documentation • Design and implement enhancements to authentication and authorization workflows • Maintain OAuth2 and OIDC integrations • Support MFA technologies including TOTP, SMS, Email, WebAuthn, and passwordless authentication • Support federation with Active Directory and Azure Active Directory • Maintain token issuance, claims mapping, scopes, audiences, and client registrations • Develop and maintain Node.js and TypeScript services • Troubleshoot production issues through code analysis and debugging • Perform dependency upgrades and security remediation • Build automation and operational tooling • Assess migration paths toward modern identity platforms • Lead technical evaluations of platforms such as Zitadel, Keycloak, Authentik, or similar • Define migration strategies for applications, clients, claims, and identity data • Drive platform simplification and reduction of technical debt • Support Elasticsearch-backed identity data stores • Troubleshoot token, session, account, permission, and client data issues • Work with Kubernetes-based deployments and GitOps workflows • Support Redis, background processing, and synchronisation services • Participate in a shared on-call rotation. • Assist with incident response, troubleshooting, root cause analysis, and continuous service improvements.