Enterprise IAM Security Engineer

What you'll do

• Design, build, and operate the systems that authenticate and authorize every employee and contractor.
• Own and manage passwordless authentication, such as passkeys, for the entire workforce.
• Define enrollment rules and authenticator assurance tiers to set security bars for different user populations.
• Build per-application authentication policies that weigh device posture, network context, and risk signals.
• Manage the non-human identity inventory, including service accounts and API keys, using short-lived credentials.
• Treat AI agents as a distinct identity class with scoped, single-use credentials and granular audit trails.
• Manage identity configuration as code by shipping and reviewing all changes through pull requests.
• Build first-party tooling for lifecycle automation, access governance, and provisioning across the SaaS stack.

What we're looking for

• Has designed, built, and operated a workforce identity platform at enterprise scale with deep hands-on Okta engineering expertise.
• Has shipped a passkey rollout on Okta at enterprise scale, including knowledge of WebAuthn and FIDO2.
• Manages identity infrastructure as code using Terraform or an equivalent tool.
• Possesses strong software engineering ability in Python, Go, or TypeScript to build first-party tooling and API-driven automation.
• Understands identity-first concepts including SSO, SAML, OIDC, SCIM provisioning, conditional access, and least privilege at scale.
• Has a proven track record of building agentic systems to eliminate manual work through AI and automation.
• Hands-on Google Workspace administration and automation (Admin SDK, directory sync, DLP) alongside Okta (preferred).
• Experience tying device trust or posture signals to access decisions, identity-aware proxy patterns, or SOC 2/SOX evidence (preferred).