Identity & Access Management (IAM) Engineer

Overview

Design, implement and operate identity and access capabilities for human users, non-human identities, workloads, devices, services and AI agents, with a focus on least privilege, separation of duties, strong authentication and automated lifecycle management.

What you'll do

• Design and operate authentication, authorization, federation, SSO, MFA, RBAC/ABAC, PAM, conditional access, policy-based authorization, just-in-time access, continuous verification and privileged-access capabilities.
• Engineer roles, groups, entitlements and privilege assignments around least privilege and separation of duties.
• Automate identity provisioning, access reviews, privilege changes, revocation and deprovisioning.
• Implement phishing-resistant MFA, cryptographically bound authentication and strong identity assurance across enrollment, authentication, federation and recovery.
• Govern service accounts, machine and device identities, workloads, automated processes, APIs and AI-agent identities.
• Implement short-lived workload and agent identities using federation, certificates and modern workload-identity approaches while reducing reliance on persistent secrets.
• Partner with architects, engineers and resource owners to ensure access is efficiently mediated and designs minimize excessive privilege, unnecessary sharing and cross-domain exposure.
• Monitor identity posture and partner with Security Operations to investigate identity threats and rapidly revoke compromised access.

What you'll need

• Hands-on experience engineering enterprise IAM systems and integrations.
• Strong knowledge of authentication, authorization, federation, identity lifecycle management, role/group design, separation of duties and least privilege.
• Knowledge of phishing-resistant MFA, cryptographic authentication, identity proofing, federation and modern identity assurance practices.
• Experience managing human and non-human identities, including service, machine, workload or device identities.
• Experience automating identity processes using APIs, scripting or Infrastructure-as-Code.
• Understanding of PKI, secrets management, short-lived credentials, workload identity federation and technologies such as OIDC, OAuth and SPIFFE/SPIRE.
• Ability to reason about identity and authorization across distributed systems and collaborate with architects and engineers on secure access design.

Details

• Remote - US.
• Base pay range: $155,000 - $195,000.