Security Engineer

Responsibilities

• Own and mature the enterprise identity platform, including identity providers, SSO, federation, and directory services across corporate, engineering, and mission environments.
• Implement authentication standards and phishing-resistant MFA using SAML, OIDC, OAuth 2.0, SCIM, FIDO2, and WebAuthn.
• Build identity lifecycle automation for joiner, mover, and leaver workflows, provisioning, deprovisioning, and just-in-time access.
• Design RBAC and ABAC models, entitlement structures, and least-privilege standards.
• Implement privileged access management and manage administrator, service-account, break-glass, machine, and workload identities.
• Operate secrets management, credential rotation, conditional access, risk-based authentication, and access review campaigns.
• Onboard SaaS and internal applications to SSO and automated provisioning using SCIM, REST APIs, and webhooks.
• Harden IAM across AWS, Azure, and GCP, including roles, trust policies, and permission boundaries.
• Write code and infrastructure as code to automate identity operations and integrations.
• Partner with security operations on identity threat detection, response, and investigations involving credential abuse, session hijacking, and MFA fatigue attacks.
• Serve as the identity subject matter expert in architecture and design reviews, maintain documentation and runbooks, and mentor junior team members.

Requirements

• At least 5 years of experience in identity and access management, security engineering, or infrastructure engineering.
• Hands-on experience administering enterprise identity providers such as Okta, Microsoft Entra ID, Ping, or Google Identity, including SSO, MFA, and conditional access.
• Strong knowledge of SAML, OIDC, OAuth 2.0, SCIM, LDAP, and Kerberos.
• Experience with identity lifecycle automation, RBAC or ABAC models, and access review processes.
• Experience with privileged access management and secrets management for human and machine identities, such as HashiCorp Vault or equivalent.
• Experience with cloud IAM in AWS, Azure, or GCP and least-privilege role and policy design.
• At least 2 years of development experience with a modern programming language such as Python, Go, C++, or Rust in lieu of a degree, or a bachelor’s degree in security engineering, cybersecurity, computer science, engineering, mathematics, or another STEM discipline.
• Preferred qualifications include a relevant bachelor’s degree, Okta Certified Administrator, Microsoft Identity and Access Administrator SC-300, CISSP, or equivalent experience.
• Preferred experience includes Terraform, CloudFormation, CDK, OPA, Cedar, ITDR, Active Directory modernization, engineering or mission environments, and defense, aerospace, or ITAR-regulated work.
• Must be comfortable with mission-critical and sensitive systems and demonstrate strong interpersonal, detail-oriented, and problem-solving skills.

Benefits

• Base salary range of $100,000–$150,000 plus equity.
• Comprehensive benefits including paid time off, medical, dental, and vision coverage, life insurance, and paid parental leave.
• The role involves access to ITAR-controlled information and requires U.S. person status or eligibility for a federally issued export control license.