System Administrator

POSITION SUMMARY Join EarnIn's IT team to own enterprise identity architecture end-to-end and lead AI-enabled automation that replaces manual workflows with scalable, auditable systems. The base salary range for this full‑time position is $221,900 - $271,200, plus equity and benefits. Our salary ranges are determined by role, level, and location. This is a hybrid position in Mountain View (Headquarters) and will require in‑office work 2 days a week. WHAT YOU'LL DO Design and evolve EarnIn's enterprise identity model with Workday as the authoritative HRIS source and Okta as the central control plane. Drive zero‑touch joiner/mover/leaver provisioning and own the program's First‑Pass Automation Yield (FPAY) metric. Architect privileged access management at scale: just‑in‑time elevation, time‑bound exceptions, managed‑device enforcement, and policy‑driven entitlement reviews. Build and maintain the IAM Roles Catalog with expiring exceptions and clear ownership for every entitlement. Lead federation strategy across AWS, Databricks, and the SaaS estate. Standardize entitlements via Identity‑as‑Code (Terraform) so every change is reviewable, diffable, and reversible. Design a Continuous Access Evaluation pipeline—manual‑grant detection, quarterly evidence packaging, tamper‑resistant sealing—so audit readiness is a standing capability rather than a quarterly scramble. Lead the design and rollout of agentic AI workflows that replace ticket‑driven, human‑in‑the‑loop IT processes: access intake, approvals routing, ownership reconciliation, helpdesk triage, and drift remediation. Build reusable AI patterns, guardrails, and components (eval harnesses, tool‑use scaffolds, prompt and policy libraries) that other EarnIn teams can adopt to AI‑enable their own workflows. Partner with team leads across the company to turn working automations into a repeatable practice. Set architectural direction for the IT team: tool selection, identity protocols (SAML, OAuth2, OIDC, SCIM), automation patterns, observability, and build‑vs‑buy decisions. Mentor IT engineers through code review, ADRs, runbooks, and design docs. WHAT WE'RE LOOKING FOR Bachelor's degree (or higher) in Computer Science, Information Systems, or a related technical field. 7+ years in IT Engineering or Identity & Access roles, including experience setting technical direction for a program and being accountable for the outcome. Demonstrated experience architecting and implementing an enterprise IAM program end‑to‑end—design, rollout, and operational steady‑state—at meaningful scale, not solely operating a vendor product. Significant hands‑on expertise in Okta (Workflows, Identity Governance, sign‑on policies, group rules) and at least one HRIS‑driven lifecycle integration (Workday preferred). Fluency in SAML, OAuth2, OIDC, SCIM, federation, JIT provisioning, and PAM patterns. Experience codifying identity infrastructure (Terraform, GitOps, or equivalent) and shipping changes through code review rather than admin consoles. Proficient in Python. Track record of systematically replacing manual processes with automation as the explicit operating model of the team—not as a side project. Demonstrated experience designing, shipping, or championing AI‑enabled workflows in a production environment (LLM‑backed agents, retrieval‑augmented assistants, or agentic automation replacing human‑in‑the‑loop steps). Uses AI‑assisted development tools (e.g., Copilot, Cursor, Claude Code) to accelerate own work. Clear written and verbal communication: able to lead an architecture review, write a decision doc, and explain why a control matters to both a developer and a CFO. Experience in a fintech or regulated environment (SOC 2, PCI) with audit‑grade evidence pipelines is a plus. Hands‑on work with Databricks federation or AWS IAM Identity Center is a plus. Certifications such as Okta Certified Consultant/Administrator or CISSP are a plus. At EarnIn, we believe that the best way to build a financial system that works for everyday people is by hiring a team that represents our diverse community. Our team is diverse not only in background and experience but also in perspective. We celebrate our diversity and strive to create a culture of belonging. EarnIn does not unlawfully discriminate based on race, color, religion, sex (including pregnancy, childbirth, breastfeeding, or related medical conditions), gender identity, gender expression, national origin, ancestry, citizenship, age, physical or mental disability, legally protected medical condition, family care status, military or veteran status, marital status, registered domestic partner status, sexual orientation, genetic information, or any other basis protected by local, state, or federal laws. EarnIn is an E‑Verify participant. #J-18808-Ljbffr