Senior IAM Engineer

Job Description:

We are hiring a Senior IAM Engineer to design, build and secure identity for both our employees and our customers. You will own how people sign in, what they can access, and how our applications and APIs trust each other.
This is a hands-on engineering role, not an SSO configuration role. You will work at the protocol level with OAuth 2.0 and OpenID Connect, lead our move to phishing-resistant MFA, and shape identity architecture across workforce IAM and customer identity (CIAM).
Key responsibilities
Application and API identity
•    Design and implement OAuth 2.0 and OpenID Connect flows for web, mobile, single-page and service-to-service applications.
•    Define how applications and APIs request, validate and use tokens, including scopes, claims, audiences, lifetimes and revocation.
•    Review application teams' identity integrations and correct insecure token handling patterns before release.
Authentication and MFA
•    Lead the rollout of phishing-resistant MFA, including FIDO2/WebAuthn passkeys and hardware security keys such as YubiKeys.
•    Plan the migration away from weaker factors (SMS, email codes, push approval) for privileged and high-risk users first.
•    Design enrollment, recovery and lost-device processes that stay secure without overwhelming the help desk.
Workforce identity
•    Own employee and contractor identity across joiner, mover and leaver processes.
•    Implement SSO, conditional access, role-based access and privileged access controls.
•    Support access reviews and audit evidence for SOC 2, ISO 27001 or similar frameworks.
Customer identity (CIAM)
•    Design customer sign-up, sign-in, social login and passwordless experiences that scale to large user populations.
•    Balance account security (account takeover protection, bot defense, step-up authentication) with conversion and user experience.
•    Support privacy and consent requirements such as GDPR and CCPA in customer identity flows.
Architecture and collaboration
•    Set identity standards and reference patterns that engineering teams can adopt.
•    Partner with security, application, product and compliance teams, and explain identity trade-offs to non-specialists.
•    Investigate and help respond to identity-related incidents.
Required qualifications
•    10+ years in identity and access management, security engineering or a closely related role, with at least 3 years hands-on in IAM.
•    Deep, protocol-level understanding of OAuth 2.0 and OpenID Connect: grant types, token types and their intended uses, token validation, and common implementation mistakes.
•    Hands-on experience deploying or engineering phishing-resistant authentication with FIDO2/WebAuthn, passkeys or hardware security keys, and the ability to explain why these methods resist phishing.
•    Experience with both workforce IAM and customer-facing identity, and a clear view of how their goals, risks and design priorities differ.
•    Working knowledge of SAML 2.0 and federation.
•    Hands-on experience with at least one major identity platform, such as Microsoft Entra ID, Okta, Ping Identity or Auth0.
•    Scripting or development skills (for example Python, PowerShell, JavaScript or C#) for automation and integration work.
•    Ability to explain technical identity concepts clearly to engineers, auditors and business stakeholders.
Preferred qualifications
•    Experience with dedicated CIAM platforms, such as Auth0, Okta Customer Identity, Microsoft Entra External ID, Ping or ForgeRock.
•    Familiarity with newer OAuth security practices, such as PKCE, token binding approaches (DPoP or mTLS), and the OAuth 2.0 Security Best Current Practice.
•    Experience with identity governance and administration (IGA) and privileged access management (PAM) tools, such as SailPoint, Saviynt or CyberArk.
•    Experience with SCIM provisioning and API gateway authorization.
•    Experience in a regulated industry, such as financial services, healthcare or legal.
•    Relevant certifications, such as CISSP, Microsoft SC-300, Okta Certified Professional or Consultant, or a CIAM vendor certification.