Identity & Access Management (IAM) Engineer
Core
Design, implement, and operate identity and access capabilities for human users, non-human identities, workloads, devices, services, and AI agents, focusing on the subject side of access control.
Role type
Senior IC IAM Engineer
Builds
Enterprise IAM systems, integrations, and secure access designs for distributed systems
Domain
Cloud Infrastructure / Cybersecurity
Required skills
IAM system engineering, authentication, authorization, federation, identity lifecycle management, role/group design, separation of duties, least privilege, phishing-resistant MFA, cryptographic authentication, identity proofing, modern identity assurance, human and non-human identity management, identity automation via APIs/scripting/IaC, PKI, secrets management, short-lived credentials, workload identity federation, OIDC, OAuth, SPIFFE/SPIRE
Preferred skills
Distributed systems architecture, secure access design, collaboration with architects and engineers
Technologies
OIDC, OAuth, SPIFFE, SPIRE, PKI, IAM platforms, Identity Federation protocols
Responsibilities
Design and operate authentication, authorization, federation, SSO, MFA, RBAC/ABAC, PAM, conditional access, policy-based authorization, just-in-time access, continuous verification, and privileged-access capabilities. Engineer roles, groups, entitlements, and privilege assignments around least privilege and separation of duties. Automate identity provisioning, access reviews, privilege changes, revocation, and deprovisioning. Implement phishing-resistant MFA, cryptographically bound authentication, and strong identity assurance. Govern service accounts, machine and device identities, workloads, automated processes, APIs, and AI-agent identities. Implement short-lived workload and agent identities using federation, certificates, and modern workload-identity approaches. Partner with architects, engineers, and resource owners to ensure efficient access mediation and minimize excessive privilege. Monitor identity posture and partner with Security Operations to investigate identity threats and revoke compromised access.
