Description
We’re looking for a Principal IAM Engineer to own the strategy and architecture of our Identity and Access Management (IAM) program. You'll set the patterns other engineers build against and make the calls that determine how we scale. You'll also help define how to secure AI agents in production, a problem the industry is still working out.
Responsibilities
- Own the multi-year IAM architecture and roadmap across human and non-human identity, cloud authorization, federation, and secrets management.
- Design and evolve AWS identity at scale, including Organizations, SCPs, IAM Identity Center, ABAC, and least-privilege patterns across hundreds of accounts.
- Architect workforce identity: SSO, adaptive MFA, SCIM provisioning, and lifecycle automation.
- Define identity patterns for AI agents and service-to-service workloads, including how they authenticate, what they can assume, and how their actions are observed and governed.
- Drive Zero Trust in practice through identity-aware access, conditional policies, and workload-level controls.
- Embed identity guardrails into Terraform and CI/CD so secure is the default path.
- Partner with Risk and GRC to turn threat exposure into pragmatic decisions, and push back on controls that add friction without reducing risk.
- Mentor engineers and raise the IAM expertise of the broader team.
Requirements
- 10+ years in cloud security or IAM, including 3+ years in staff, or architect role owning technical direction.
- Deep AWS IAM expertise: multi-account Organizations, SCPs, IAM Identity Center, ABAC, and secrets management (AWS Secrets Manager, HashiCorp Vault, or similar).
- Enterprise workforce identity experience with Okta or an equivalent platform (Entra ID, Ping, etc.), including SSO, MFA, SCIM, and lifecycle management.
- Strong working knowledge of SAML, OIDC, and OAuth2, including debugging them in complex environments.
- Terraform fluency and an understanding of how identity controls are enforced through CI/CD.
- A track record of driving alignment across engineering, security, and business teams without positional authority.