Your day-to-day will blend hands-on engineering (writing code, building integrations, tuning controls) with architecture and program ownership (setting standards, defining patterns, and driving adoption across teams). You will be responsible for turning high-level objectives,like “implement zero trust for workforce access” or “deploy phishing-resistant MFA at scale”,into concrete designs, automation, and measurable risk reduction.

In this role, you will:

• Engineer modern identity and access controls
• Design, implement, and operate workforce identity solutions (e.g., Okta/Entra and other IdPs) including SSO, MFA, conditional access, and lifecycle automation via SCIM.
• Develop and roll out phishing-resistant MFA for high-value accounts and critical access paths (e.g., FIDO2/WebAuthn, hardware keys, device-bound authenticators).
• Define and maintain RBAC/IAM patterns for enterprise applications (role models, groups, entitlements, JIT access, and approvals).

• Implement zero trust for workforce and enterprise access
• Design and deploy controls that combine user identity, device posture, network context, and application sensitivity to enforce least-privilege access.
• Partner with Network and Infrastructure teams to integrate mTLS, service identity, and policy-based access into internal services and admin interfaces.
• Help transition from legacy perimeter models to zero trust network access (ZTNA) patterns for employees, contractors, and third parties.

• Secure SaaS and collaboration platforms
• Evaluate, onboard, and harden SaaS applications (Google Workspace, Microsoft 365, Slack, HRIS, ticketing, and other business apps) to align with enterprise security policies.
• Implement and tune controls such as SCIM provisioning, data access policies, DLP, sharing controls, and audit logging across the SaaS estate.
• Partner with business and IT owners to ensure new SaaS applications meet baseline security standards before adoption.

• Harden endpoints and the extended workforce
• Collaborate with Endpoint/IT teams to define and enforce baseline configurations for laptops, workstations, and other managed devices via MDM and EDR.
• Design secure patterns for contractor and vendor access, including device requirements, identity separation, and time-bound access.
• Support investigations and incident response related to identity, endpoint, and SaaS domains.

• Automate and instrument everything you can
• Build automation and self-service experiences for access requests, approvals, access reviews, and break-glass workflows.
• Develop integrations between IdPs, HRIS, ticketing, and other systems to minimize manual toil and reduce identity-related error rates.
• Define and instrument metrics for enterprise security (e.g., MFA coverage, zero trust policy enforcement, joiner/mover/leaver SLA adherence, SaaS posture).

• Partner on detection, response, and governance
• Work with Security Operations and SIEM teams to ensure robust visibility into identity, device, and SaaS activity, and to build high-signal detections.
• Contribute to policies, standards, and reference architectures that encode enterprise security expectations.
• Author clear documentation and runbooks that make it easy for teams to consume and operate the controls you build.

XML job scraping automation by YubHub