Sr. Staff IAM Engineer

Role Description

OpenLoop’s mission is to bring care anywhere by powering telehealth solutions at scale. We are hiring a Sr. Staff IAM Engineer (Architect) to be the design authority for identity across the company: workforce, non-employee, customer, partner, non-human, and AI agent.

This is a hands-on architecture role, and we mean that concretely. Expect to write Auth0 Actions, Okta Workflows, and Terraform, and to query the posture warehouse yourself. Identity controls here carry HIPAA, HITRUST, and SOC 2 weight. The person who does well in this role is comfortable in ambiguity, writes decisions down, and can explain a design tradeoff to a staff engineer and to a CISO in the same week.

What You’ll Do:

• Own the target-state identity architecture across workforce, non-employee, external, non-human, and AI agent identity types.
• Set the standards, reference patterns, and decision records that make platform choices consistent rather than improvised per project.
• Own our Auth0 customer identity architecture end to end, including tenant and organization modelling, MFA and phishing-resistant authentication, and machine-to-machine patterns.
• Keep the customer and patient identity plane deliberately separate from the workforce plane.
• Define the interfaces where the two must meet, and design the external and partner identity models for third-party developers and B2B customers.
• Own the architecture for consolidating our remaining authentication paths onto a single workforce IdP.
• Design SSO, SCIM provisioning, and automated deprovisioning patterns for applications handling sensitive data.
• Define the federation and directory architecture across Okta, Entra ID, AWS, and GCP.
• Build out Identity Security Posture Management, extending the posture warehouse and remediation engine.
• Partner with Security Operations and Security Architecture to design identity threat detection and response into our existing SIEM.
• Design access controls that satisfy HIPAA, HITRUST, and SOC 2 requirements without adding manual overhead.
• Serve as the design authority between the function that surfaces identity risk and the function that builds.

Qualifications

• 8+ years in identity and access management, security engineering, or platform architecture, with at least 3 years at a staff, principal, or architect level.
• Deep, hands-on customer identity experience, ideally on Auth0.
• Strong command of federation and authentication protocols: SAML, OIDC, OAuth 2.0, SCIM, WebAuthn and FIDO2.
• Enterprise workforce IdP architecture experience, on Okta or equivalent.
• Demonstrated ability to set architectural direction and get engineering teams to adopt it without direct authority.
• Clear written communication, including architecture decision records and reference designs.

Requirements

• Designing for HIPAA and PHI safeguards, or comparable regulated-industry access requirements.
• Identity governance depth: joiner-mover-leaver lifecycle, RBAC, access certification, segregation of duties.
• Cloud PAM and zero standing privilege models, particularly Britive or similar just-in-time access tooling.
• Cloud-native identity across AWS, GCP, and Azure.
• Building Identity Security Posture Management or identity threat detection capability.
• Non-human identity, service account governance, secrets management, or AI agent identity.
• Infrastructure as code for identity, including Terraform.
• HITRUST, SOC 2, or SOX access controls.
• Certifications such as CISSP or CISSP-ISSAP, CISM, TOGAF or SABSA, Okta Certified Consultant or Architect, Auth0, SailPoint, or a professional-level cloud architect certification.
• Digital health, telehealth, or another regulated high-growth environment.

Benefits

• Medical, Dental, and Vision plans
• Flexible Spending/Health Savings Accounts
• Flexible PTO
• 401(k) + Company Match
• Life Insurance, Pet insurance, and more

Company Description

We have a relatively flat organizational structure here at OpenLoop. Everyone is encouraged to bring ideas to the table and make things happen. This fits in well with our core values of Autonomy, Competence and Belonging, as we want everyone to feel empowered and supported to do their best work.