Senior Identity Engineer

Responsibilities

• Architect and manage HR-driven provisioning by integrating Okta with Workday (Workday-as-a-Master) to automate complex attribute mapping and secure JML lifecycles.
• Engineer and deploy robust SSO (SAML 2.0, OIDC, OAuth 2.0) and SCIM provisioning for major enterprise applications, particularly Salesforce and Google Workspace.
• Design least-privilege policies and manage AWS Identity Security, including cross-account role assumption, identity federation via Okta, and AWS SSO (Identity Center).
• Implement decoupled authorization for cloud-native applications utilizing Open Policy Agent (OPA) and authoring strict access policies in Rego.
• Secure autonomous AI workflows by assigning distinct identities to AI models, governing their API access, and applying strict sandboxing.
• Own the lifecycle for traditional non-human identities (service accounts, OAuth tokens, API keys, X.509 certificates) to prevent secret sprawl.
• Implement zero-trust device posture checks by integrating MDM telemetry and device certificates with Okta for macOS and Windows endpoints.
• Mentor junior engineers, conduct architecture reviews, write documentation/runbooks, and elevate identity security maturity.

Requirements

• 5+ years of hands-on experience engineering, deploying, and managing enterprise IAM environments with deep Okta expertise.
• Strong hands-on background in AWS IAM, OPA, Rego, and designing zero-trust cloud architectures.
• Proven track record discovering, managing, and rotating machine identities, with a forward-looking approach to securing programmatic AI workflows.
• Advanced experience integrating core HRIS platforms (Workday) with Identity Providers, and managing complex fleet authentication (macOS/Windows).
• Solid understanding of access control principles in highly regulated sectors (e.g., Healthcare, HIPAA, Privacy), including continuous access reviews and audit logging.
• Passion for maintaining detailed documentation and translating complex identity concepts into scalable, automated solutions.

Nice-to-Haves

• Okta, AWS or SANS relevant Identity certifications.
• Deep experience mapping identity controls directly to ISO, SOC2, HITRUST, and specific privacy regulation frameworks.