# Staff Security Engineer, IAM

**Company:** [GitLab](https://hotfix.jobs/companies/gitlab)
**Location:** Remote
**Role:** Security Engineering
**Salary:** $168k – $238k/yr
**Experience:** 7+ years
**Skills:** IAM, Okta, Okta Identity Engine, Terraform, Opentofu, Pulumi, Python, Gcp Cloud Run, GCP, AWS, Workload Identity Federation, Scps, Permission Boundaries, Claude, SCIM
**Posted:** 2026-08-31

> Staff-level security engineer leading enterprise IAM, cloud identity, AI platform access, and non-human identity governance. The role requires deep Okta, infrastructure-as-code, Python, GCP or AWS, and regulated-environment experience.

## Job Description

## Responsibilities
- Design scalable identity and AI access solutions, including AI agent governance and just-in-time privileged access workflows.
- Replace low-code automation with tested, source-controlled Python services deployed on GCP Cloud Run or an equivalent runtime.
- Codify Okta, Lumos, and non-human identity platforms using Terraform, OpenTofu, or Pulumi.
- Re-architect identity and access across GCP and AWS organizations, including resource hierarchies, organization policies, SCPs, permission boundaries, and workload identity federation.
- Lead identity and access engineering for enterprise AI platforms, including administration, SSO, SCIM, audit logging, data controls, and policy enforcement.
- Develop governance for service accounts, API keys, certificates, AI agents, and MCP integrations; deploy and operationalize a non-human identity platform.
- Translate ambiguous cross-functional requirements into technical specifications and lead initiatives across Security, IT, Engineering, Enterprise AI, Compliance, and People teams.
- Mentor engineers on technical implementation and modern identity and AI security practices.

## Requirements
- Extensive enterprise IAM experience, including work at Staff or senior individual-contributor level.
- Expert Okta experience with Identity Engine, advanced authentication policies, lifecycle workflows, and API automation.
- Strong infrastructure-as-code experience with Terraform, OpenTofu, or Pulumi, including SaaS identity-platform providers and click-ops migrations.
- Proficiency writing, testing, reviewing, deploying, and instrumenting modular Python services.
- Deep cloud identity experience in GCP and/or AWS, including organization design, IAM policy models, workload identity federation, and preventive controls.
- Experience administering or governing enterprise AI platforms; Anthropic Claude preferred, with OpenAI ChatGPT Enterprise, Google Gemini Enterprise, or similar accepted.
- Understanding of AI security risks including prompt injection, MCP attack surfaces, agent identity, and data leakage.
- Regular hands-on use of AI development tools such as Claude Code or Cursor.
- Experience with IGA platforms such as Lumos or ConductorOne, preferably managed declaratively.
- Experience in regulated environments and familiarity with FedRAMP, SOC 2, or SOX compliance, change management, evidence collection, and audit support.

## Nice to Have
- Experience with AI agent governance, non-human identity management, zero-trust architecture, or behavioral analytics.
- Experience completing cloud organization restructuring, including migrations and stakeholder management.

## Compensation and Benefits
- United States base salary: **$168,000–$238,000 USD annually**.
- The range excludes bonuses, equity, and benefits.
- Benefits include flexible paid time off, equity compensation and employee stock purchase plan, a growth and development fund, parental leave, and team member resource groups.

## Similar jobs

- [Staff Security Researcher](https://hotfix.jobs/jobs/6b308cd8-be33-459a-b904-08e54567ad7b) - GitLab - Remote - $168k – $238k/yr
- [Staff Corporate Security Engineer](https://hotfix.jobs/jobs/f89034fc-b54a-4d06-a7c4-971c896526ac) - GitLab - Remote - $168k – $238k/yr
- [Staff IAM Engineer](https://hotfix.jobs/jobs/7a722d47-b173-4ffc-9981-f10ed9f3ce9c) - Ironclad - San Francisco, CA - $170k – $190k/yr
- [Staff Vulnerability Management Engineer](https://hotfix.jobs/jobs/f6eb93ea-70d6-496f-a251-e679113fd047) - Chainguard - Remote - $170k – $231k/yr
- [Staff Identity Governance and Access Engineer](https://hotfix.jobs/jobs/8fe7fe60-ff7a-48f4-a805-f3f100e1814f) - Okta - Bellevue, WA - $161k – $221k/yr

**Apply:** https://hotfix.jobs/jobs/f79f024d-e0b6-41b0-b434-9f047bfa2630
**Canonical:** https://hotfix.jobs/jobs/f79f024d-e0b6-41b0-b434-9f047bfa2630