Staff Identity Governance and Access Engineer

What you'll do

• Own the end-to-end OIG architecture, including access request workflows and certification campaigns.
• Lead the enterprise strategy for birthright provisioning, RBAC frameworks, and joiner/mover/leaver processes.
• Drive Workday integration architecture to balance scheduled reconciliation with real-time attribute synchronization.
• Design and harden automated mover/leaver processes to decommission stale access and re-evaluate group memberships.
• Lead OPA, ISPM, and Zero Standing Privilege initiatives, including JIT elevation and break-glass access.
• Establish and track telemetry and KPIs for privileged access, JIT adoption, and stale access cleanup.
• Build and maintain Okta Workflows to automate access requests, approvals, and remediation processes.
• Mentor engineers, review technical designs, and present risk assessments and roadmaps to executive stakeholders.

What we're looking for

• Must have at least 4 years of direct experience managing and administering enterprise IGA, PAM, and ISPM tools.
• Must have hands-on experience designing and deploying Birthright Provisioning models and RBAC architectures in production.
• Must have production experience with OPA or equivalent PAM tooling, including Zero Standing Privilege and Just-In-Time access.
• Must have production experience with ISPM tools that integrate with EDR solutions like Crowdstrike Falcon.
• Must have a solid grounding in identity standards including SAML, OIDC, OAuth 2.0, and SCIM.
• Must have experience operating in SOX and compliance-critical environments with an understanding of audit evidence and segregation of duties.
• Must be a U.S. person (citizen, lawful permanent resident, or protected individual) and physically located on U.S. soil.
• U.S. citizen as defined in 42 U.S. Code § 9102.