Security Software Engineer, IAM

Responsibilities

• Own IAM strategy across corporate, production, and product environments, including the connection between corporate IAM and product/production IAM.
• Migrate Okta and related IAM configuration to Terraform so identity changes are reviewed, tested, and versioned as infrastructure code.
• Build self-service access governance and just-in-time access tooling for defining, requesting, and time-bounding access.
• Own provisioning, deprovisioning, access review, and audit-evidence workflows for SOC 2 and similar audits.
• Partner with the Accounts team on product IAM capabilities such as team and project roles, enterprise SSO, SCIM, and API tokens.
• Design and enforce least-privilege access controls across cloud, SaaS, and production infrastructure.
• Help define and implement identity and access models for agents acting on behalf of users and systems.

Requirements

• 7+ years of experience in identity, access management, or platform security engineering.
• Experience building internal tools or self-service platforms rather than only administering existing identity products.
• Proficiency in a production language such as TypeScript/Node.js, Go, or Python, with experience designing and consuming REST APIs and operating reliable services.
• Proficiency in Terraform and experience managing IAM infrastructure as code; IAM migration experience is preferred.
• Hands-on implementation-level experience with OAuth2, OIDC, SAML, and SCIM, including identity and token failure modes.
• Experience designing IAM at scale across corporate environments such as Okta and production environments such as AWS or GCP IAM.
• Ability to collaborate across Engineering, IT, Compliance, and Security and operate autonomously.
• Preferred qualifications include leading large-scale Terraform IAM migrations, building JIT access or access governance platforms, managing Jamf or Intune and device-trust integrations, understanding product IAM, and experience with agent identity.
• Certifications such as Okta Certified Professional/Administrator, AWS Security Specialty, or CISSP are preferred but not required.

Benefits

• Competitive compensation package including equity, with a San Francisco base pay range of $208,000–$312,000.
• Inclusive healthcare package.
• Mentorship and support for attending professional events.
• Flexible time off.
• Company-provided equipment and a work-from-home budget.
• Remote within the United States; employees within commuting distance of San Francisco or New York offices have anchor days on Monday, Tuesday, and Friday.