Senior Security Engineer, Identity

Quick Facts

• Role: Senior Security Engineer, Identity

Description

You will own and evolve the identity and access layer into an IAM-as-a-service platform used across the organization. This is a hands-on role where you design how identity works and implement it in code (including Terraform-based identity configuration), govern entitlements via an IGA platform, and support an agentic workflow and an on-call identity assistant.

What You’ll Do

• Own Terraform for identity services: Okta applications, authorization servers, authentication policies, groups and group rules, and SCIM provisioning

• Design and operate custom authorization servers (audiences, scopes, claims, access policies) for internal services and AI agents

• Implement app-to-app and agent access through Cross App Access (XAA) and ID-JAG so delegated access is brokered and governed by the IdP

• Own the IGA platform: entitlement catalog, ownership, access requests, time-bound grants, and certifications

• Build an agentic workflow that turns access needs into a defined, owned, governed entitlement with Terraform and IGA changes opened for review

• Build identity graphs with ISPM tooling to find overprivileged and long-standing access across human and non-human identities

• Build the identity data lake behind an on-call agent that explains identity events (e.g., Okta “User Not Assigned Application”)

Requirements

• 6+ years in identity engineering or IAM with operational ownership of Okta (or an equivalent identity provider) at scale

• Deep understanding of OAuth 2.0, OIDC, SAML, and SCIM, including how custom authorization servers issue and enforce aud, scope, and claims

• Working knowledge of XAA and ID-JAG, including token exchange and JWT bearer grants

• Experience with ISPM/identity graph tooling and turning findings into automated remediation

• Experience owning an IGA platform or building an equivalent in-house

• Terraform experience managing identity providers, including module design, state, and CI

• Programming in Python or Go, with experience building against platform APIs

Benefits

• Flexible PTO

• Centralized home-office equipment ordering

• Health and wellness stipend

• Budget for intra-office travel and weekly coffee stipend

• Comprehensive medical/dental/vision coverage (region-specific), plus 401(k) with employer match

• Fertility HRA and parental leave (region-specific details)

• Relocation expense coverage to NYC or SF if needed (as applicable)

• Additional region-specific benefits (e.g., insurance, retirement, and healthcare support)