# Security Software Engineer, IAM

**Company**: Vercel
**Location**: San Francisco, CA
**Work arrangement**: hybrid
**Experience**: senior
**Job type**: full-time
**Salary**: $208,000 - $312,000
**Category**: Engineering
**Industry**: Technology

**Apply**: https://job-boards.greenhouse.io/vercel/jobs/6093255004?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply
**Canonical**: https://yubhub.co/jobs/job_180aabb7-bcf

## Description

## About the role

We are looking for a Security Software Engineer, IAM, to build identity and access management (IAM) infrastructure as software, not administer identity products. You will own identity and IAM end to end, replacing the approval queue with access that is self-serve, time-bound, and provable, built so identity is defined as code, reviewed in pull requests, deployed through CI, and observable in production.

## Responsibilities

- Migrate Okta and related IAM configuration to Terraform so every identity change is reviewed, tested, and versioned, and help engineering teams adopt infrastructure as code.

- Build a self-serve access platform, including just-in-time (JIT) access, that lets team and system owners define, request, and time-bound their own access.

- Own provisioning, deprovisioning, and access review workflows that generate System and Organization Controls 2 (SOC 2) audit evidence automatically.

- Unify corporate IAM (employee identity, SaaS access, devices) and production IAM (service accounts, infrastructure permissions, on-call access) into one identity plane, and enforce least-privilege access across cloud, SaaS, and production infrastructure.

- Define and build how agents request and hold access, working with the Accounts team on product-facing identity.

## Requirements

- 7+ years building and owning identity, access management, or platform security systems, including IAM design across corporate (Okta or equivalent) and production (AWS or GCP) environments.

- Built and operated production services or self-service platforms in TypeScript/Node.js, Go, or Python, including REST APIs.

- Implemented OAuth2, OpenID Connect (OIDC), Security Assertion Markup Language (SAML), and System for Cross-domain Identity Management (SCIM) at the protocol level, including failure modes such as token replay and sync drift.

- Managed IAM infrastructure as code in Terraform.

## Bonus skills

- Led a Terraform migration for IAM or identity infrastructure at scale.

- Designed or built a JIT access system or access governance platform.

- Designed delegation or scoped-credential models for agents or service identities.

## Compensation & Benefits

- Competitive compensation package, including equity.

- Inclusive Healthcare Package.

- Learn and Grow - we provide mentorship and send you to events that help you build your network and skills.

- Flexible Time Off.

- We will provide you the gear you need to do your role, and a WFH budget for you to outfit your space as needed.

The San Francisco, CA base pay range for this role is $208,000 - $312,000. Actual salary will be based on job-related skills, experience, and location.

## Skills

### Required
- Terraform
- Okta
- IAM
- OAuth2
- OpenID Connect
- SAML
- SCIM
- TypeScript/Node.js
- Go
- Python
- REST APIs

### Nice to have
- Terraform migration
- JIT access system
- access governance platform
- delegation or scoped-credential models

---

Source: [Apply at job-boards.greenhouse.io](https://job-boards.greenhouse.io/vercel/jobs/6093255004?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply)