Principal Identity Architect

OverviewAs a Principal Identity Architect, you will lead Epsilon’s identity modernization—transitioning from legacy SAML and long-lived credentials to a modern, OAuth 2.1 / OpenID Connect (OIDC)-first model. You’ll design secure, scalable identity patterns across multi-cloud environments while enabling teams to build with speed and confidence.You’ll partner closely with Security, Cloud, Platform, and Engineering teams to replace API keys and service accounts with scoped, ephemeral machine identities, establish enterprise standards, and deliver secure, developer-friendly integrations.This is a hands-on leadership role for someone who can drive strategy, mentor engineers, and turn architecture into real-world implementations.ResponsibilitiesWhat You’ll AcheiveModern Identity ArchitectureLead adoption of OAuth 2.1 / OIDC; drive migration from SAML and legacy authDesign secure token flows (Auth Code + PKCE, Client Credentials, delegated access)Define standards for token usage, scopes, claims, and lifecycle managementReduce risk from token leakage, replay, and over-permissioningMachine & Non-Human IdentityReplace long-lived credentials with modern machine identity patternsDesign M2M authentication for APIs, data pipelines, and platform workloadsPartner with teams on service account migration and secrets reductionPlatform & Integration EngineeringBuild reusable identity patterns across IdPs, API gateways, and cloud platformsEnable secure, scalable access across AWS, Azure, and/or GCPTroubleshoot complex auth issues in hybrid and multi-cloud environmentsSecurity, Governance & ObservabilityApply Zero Trust principles (least privilege, scoped access)Improve identity logging, monitoring, and audit readinessEstablish governance for OAuth apps, scopes, and access policiesLeadership & DeliveryDrive identity modernization programs end-to-endMentor architects and engineers; set technical standardsBreak down complex initiatives into actionable workstreamsLead incident response and improve operational visibilityQualificationsWho you AreWhat you’ll Bring with youBachelors or Masters in Computer Science or related field.7+ years in IAM, security engineering, or platform roles3+ years hands-on with OAuth 2.0 / OIDC in productionStrong expertise in token flows, scopes, claims, and secure design patternsExperience implementing machine identity (M2M, workload identity, etc.)Track record of modernizing identity (SAML → OIDC or similar)Experience with AWS, Azure, or GCP identity servicesAbility to lead initiatives, influence teams, and deliver at scaleHow you’ll Stand out from other TalentExperience with API security, data platforms, or service-to-service auth at scaleFamiliarity with SPIFFE/SPIRE, OPA, or advanced authorization modelsExperience with Okta, Entra ID (Azure AD), Auth0, or PingExposure to AI/agent-based identity patternsScripting or automation (Python, Bash)Click here to view how Epsilon transforms marketing with 1 View, 1 Vision, 1 Voice.Additional InformationWhen you join Epsilon, we’ll create something EPIC together. We’re a global leader in data and identity, with deep expertise in digital media, clean rooms, customer data platforms, loyalty and marketing services. Positioned at the center of Publicis Groupe, Epsilon helps brands deliver personalized experiences at scale and build lasting customer relationships by unlocking the full potential of data and identity. Epsilon operates in 30+ countries across EMEA, the Americas and APAC, with more than 8,000 employees.Check out a few of these resources to learn more about what makes Epsilon so EPIC:Our Culture:Life at Epsilon: Epsilon has five values that define our culture and guide us as we create value for our clients, our people and consumers. We seek candidates who align with our company values, demonstrate them and make them meaningful in their day-to-day work:Act with integrity. We are transparent and have the courage to do the right thing.Work together to win together. We believe collaboration is the catalyst that unlocks our full potential.Innovate with purpose. We shape the market with big ideas that drive big outcomes.Respect all voices. We embrace differences and foster a culture of connection and belonging.Empower with accountability. We trust each other to own and deliver on common goals.Because You MatterAs an Epsilon employee, you deserve perks and benefits that put you, your family and your finances first. Our benefits encompass a wide range of offerings, including but not limited to:Time to recharge: Flexible time off (FTO), 14 paid holidays, paid sick timeFamily well-being: Parental/new child leave, childcare & elder care assistance, adoption assistanceExtra perks: Comprehensive health coverage, 401(k), tuition assistance, commuter benefits, professional development, employee recognition, charitable donation matching, health coaching and counselingEpsilon benefits are subject to eligibility requirements and other terms.Epsilon is an Equal Opportunity Employer. Epsilon’s policy is not to discriminate against any applicant or employee based on actual or perceived race, age, sex or gender (including pregnancy), marital status, national origin, ancestry, citizenship status, mental or physical disability, religion, creed, color, sexual orientation, gender identity or expression (including transgender status), veteran status, genetic information or any other characteristic protected by applicable federal, state or local law. Epsilon also prohibits harassment of applicants and employees based on any of these protected categories. Epsilon will provide accommodations to applicants who need accommodations to complete the application process. Please reach out to View email address on click.appcast.io to request an accommodation.For San Francisco Bay and Los Angeles Areas: Epsilon will consider qualified applicants with criminal histories for employment in a manner consistent with the City of Los Angeles’ Fair Chance Initiative for Hiring Ordinance and San Francisco Police Code Sections 4901-4919, commonly referred to as the San Francisco Fair Chance Ordinance. Applicants with criminal histories are welcome to apply. #LI-TG1Compensation Range: USD $127,900.00 - USD $237,500.00/Annually. This is the pay range the Company believes it will pay for this position at the time of this posting. Consistent with applicable law, compensation will be determined based on the skills, qualifications, and experience of the applicant along with the requirements of the position, and the Company reserves the right to modify this pay range at any time. Temporary roles may be eligible to participate in our freelancer/temporary employee medical plan through a third-party benefits administration system once certain criteria have been met. For regular roles, the Company will offer medical coverage, dental, vision, disability, 401k, and paid time off. The Company anticipates the application deadline for this job posting will be 10/12/2026.