Full-Stack Software Engineer

Manulife•Boston, MA

1d•Hybrid

About The Position

Join our Customer identity & access management engineering team as a full-stack engineer focused on CIAM using IBM Security Verify. You’ll help build secure, customer-friendly authentication and authorization experiences across our digital channels, working with Node.js and React under guidance from senior engineers.

Requirements

1–2 years of software development experience (internships/co-ops included) or strong project-based portfolio.
Proficiency in JavaScript/TypeScript, Node.js (Express/NestJS), and React (Hooks, Context; basic state management).
Basic understanding of OAuth 2.0, OIDC, JWT, and web auth flows (authorization code + PKCE).
Familiarity with REST APIs, JSON, and front-end routing (React Router or Next.js).
Knowledge of core web security concepts: XSS, CSRF, CORS, secure cookies.
Experience with Git and CI/CD basics (GitHub Actions, GitLab CI, or Azure DevOps).
Strong problem-solving, willingness to learn, and attention to detail.

Nice To Haves

Exposure to IBM Security Verify (CIAM) configuration: apps, policies, MFA, branding, and user management.
Experience with MFA methods (TOTP, push, SMS/email) and WebAuthn/passkeys.
Understanding of accessibility (WCAG) and performance tooling (Lighthouse).
Familiarity with cloud platforms (AWS/Azure/GCP), Docker, and Terraform basics.
Experience with testing tools: Jest, React Testing Library, Cypress, Postman.

Responsibilities

Implement and maintain CIAM features: registration, login, MFA, account recovery, consent, and profile management using IBM Security Verify.
Build and update Node.js/TypeScript APIs and microservices (Express or NestJS) for auth and user profile flows.
Develop React components/pages for authentication UX (hosted pages and embedded widgets) with accessibility and performance in mind.
Integrate with IBM Security Verify: configure applications, policies, user directories, branding, and hooks; assist with SSO and social login setups.
Apply standards and best practices for OAuth 2.0, OIDC, and JWT (including PKCE) across web and mobile flows.
Implement secure session and token handling; contribute to CSRF/XSS/CORS mitigations and secure cookie management.
Write tests (unit/integration/e2e) and participate in code reviews; document features and runbooks.
Support CI/CD pipelines, environment configuration, and monitoring for identity services.
Troubleshoot issues, triage bugs, and assist in root-cause analysis with senior guidance.