# Staff Identity Governance and Access Engineer

**Company:** [Okta](https://hotfix.jobs/companies/okta)
**Location:** Bellevue, WA, Chicago, IL, Washington, DC
**Role:** Security Engineering
**Salary:** $161k – $221k/yr
**Experience:** 7+ years
**Skills:** Okta Identity Governance, Okta Privileged Access, Ispm, RBAC, Birthright Provisioning, SAML, OIDC, Oauth 2.0, SCIM, Okta Workflows, Workday, Servicenow, Jira, REST APIs, Crowdstrike Falcon
**Posted:** 2026-09-05

> Own the architecture and automation of enterprise identity governance, privileged access, and identity security posture programs. The role requires advanced IGA/PAM experience, production RBAC and lifecycle expertise, and the ability to lead technical direction and communicate with executives.

## Job Description

## Responsibilities
- Own Okta Identity Governance (OIG) architecture, including access-request workflows, entitlement and resource-collection structures, and certification campaigns.
- Lead lifecycle, birthright provisioning, role-based access control (RBAC), and joiner/mover/leaver (JML) strategy across the enterprise.
- Drive Workday integration architecture, including scheduled reconciliation, real-time synchronization, and access-rule attributes.
- Design and harden mover/leaver automation, including role-change group re-evaluation and stale-access decommissioning.
- Lead Okta Privileged Access (OPA), Identity Security Posture Management (ISPM), and Zero Standing Privilege initiatives, including privileged sessions, just-in-time elevation, break-glass access, vulnerability detection, and system tiering.
- Establish PAM and ISPM telemetry, KPIs, and operational metrics.
- Build and maintain Okta Workflows automation for access requests, approvals, and remediation.
- Mentor engineers, review designs, serve as a technical escalation point, and communicate risks and roadmaps to leadership.

## Requirements
- 4+ years of direct, advanced experience managing and administering enterprise IGA, PAM, or ISPM platforms.
- Production experience designing and deploying birthright provisioning models and RBAC architectures.
- Production experience with OPA or equivalent PAM tooling, including Zero Standing Privilege, just-in-time access, break-glass design, and administrative tiering.
- Production experience with ISPM tools integrated with EDR solutions such as CrowdStrike Falcon.
- Knowledge of SAML, OIDC, OAuth 2.0, SCIM, and role- or attribute-based access control.
- Experience owning identity lifecycle designs from design through production rollout.
- Experience in SOX and compliance-critical environments, including audit evidence, segregation of duties, and access certification integrity.
- Ability to work autonomously and communicate updates, risks, and roadmaps to executives.
- Must work on U.S. soil and qualify as a U.S. person under applicable requirements.

## Nice-to-haves
- Experience governing non-human identities, including service accounts, API tokens, secrets, AI agents, and workload identities.
- Experience scaling access certification programs.
- Familiarity with ServiceNow and Jira-based service request intake.
- Okta Certified Administrator, Okta Certified Consultant, or Okta Workflows Specialist certification.
- Experience with REST APIs, JSON parsing, webhooks, and Workday-to-identity-provider integrations.
- Experience supporting SOC 2, ISO 27001, HIPAA, or GDPR audits.

## Compensation and Benefits
- Annual base salary: $161,000–$221,000 USD.
- Equity, bonus, health, dental and vision insurance, 401(k), flexible spending account, paid time off, and parental leave may be available under applicable plans and policies.

## Similar jobs

- [Staff Identity Engineer](https://hotfix.jobs/jobs/9840c62b-d314-4749-aa98-2057f5343be2) - Okta - Bellevue, WA - $161k – $221k/yr
- [Staff Security Engineer](https://hotfix.jobs/jobs/29576103-a601-455c-a963-ce04128098e5) - Twilio - Remote - $156k – $194k/yr
- [Staff Enterprise Security Engineer, AI Security](https://hotfix.jobs/jobs/f0299624-eaec-4b80-89d9-94fde4d866e9) - Twilio - Remote - $156k – $194k/yr
- [Staff Security Researcher](https://hotfix.jobs/jobs/6b308cd8-be33-459a-b904-08e54567ad7b) - GitLab - Remote - $168k – $238k/yr
- [Staff Security Engineer, IAM](https://hotfix.jobs/jobs/f79f024d-e0b6-41b0-b434-9f047bfa2630) - GitLab - Remote - $168k – $238k/yr

**Apply:** https://hotfix.jobs/jobs/8fe7fe60-ff7a-48f4-a805-f3f100e1814f
**Canonical:** https://hotfix.jobs/jobs/8fe7fe60-ff7a-48f4-a805-f3f100e1814f