Security Engineer designing controls for Kinaxis’s AI - powered supply - chain orchestration platform and corporate IT environments. Leading cloud security, vulnerability remediation, detection, and incident response.
About the role
- Staff Security Engineer securing identity, cloud access, and AI platforms for GitLab’s DevSecOps platform. Engineering automated governance across Okta, GCP, AWS, and non-human identities.
Responsibilities
- Design comprehensive identity and AI access solutions, including AI agent governance frameworks and privileged access workflows with just-in-time provisioning
- Replace low-code automation with engineered Python services on GCP Cloud Run with source control, tests, CI, and observability
- Codify Okta, Lumos, and non-human identity platforms in Terraform/OpenTofu/Pulumi and migrate click-ops to peer-reviewed infrastructure-as-code
- Re-architect identity and access across GCP and AWS organizations, including resource hierarchy, secure-by-default guardrails, workload identity federation, and least-privilege access
- Lead identity and access engineering for enterprise AI platforms, including administration, SSO and SCIM integration, audit logging, data controls, and policy enforcement
- Design monitoring and management solutions for service accounts, API keys, certificates, AI agents, and MCP integrations; deploy and operationalize the NHI platform
- Drive cross-functional initiatives with Security, IT, Engineering, Enterprise AI, and the Office of the CIO
- Mentor senior and intermediate engineers on technical implementation and strategic thinking
Requirements
- Extensive IAM experience designing and implementing enterprise-scale solutions, with demonstrated time at a Staff or senior IC level
- Expert-level Okta expertise including Identity Engine, advanced authentication policies, lifecycle workflows, and API automation
- Strong infrastructure-as-code practice with Terraform/OpenTofu/Pulumi, including provider experience for SaaS identity platforms and a track record of migrating click-ops to code
- Proficiency writing and shipping Python as a software engineer, designed as modular, tested, code-reviewed, deployed as services (GCP Cloud Run or equivalent serverless runtime) and instrumented for failure
- Cloud identity depth in GCP and/or AWS, including resource hierarchy and organization design, IAM policy models, workload identity federation, and preventive controls such as org policies, SCPs, and permission boundaries
- Hands-on experience administering or governing enterprise AI platforms (Anthropic Claude preferred; OpenAI ChatGPT Enterprise, Google Gemini Enterprise, or similar acceptable)
- Awareness of AI-specific risks including prompt injection, MCP attack surface, agent identity, and data leakage
- Daily engineering practice with AI tooling such as Claude Code, Cursor, or similar
- Experience with IGA platforms like Lumos, ConductorOne, or similar, with a preference for managing them declaratively
- Experience in regulated environments with knowledge of compliance frameworks (FedRAMP, SOC2, SOX), including change management, evidence collection, and audit support
- Passion for emerging identity challenges including AI agent governance, non-human identity management, zero-trust architecture, and behavioral analytics
- Experience carrying a cloud org restructuring through to completion, including migration and stakeholder work
Benefits
- Benefits to support your health, finances, and well-being
- Flexible Paid Time Off
- Team Member Resource Groups
- Equity Compensation & Employee Stock Purchase Plan
- Growth and Development Fund
- Parental Leave
Job title
Job type
Experience level
Salary
Degree requirement
No Education Requirement
Tech skills
Location requirements
Report this job
Found something wrong with the page? Please let us know by submitting a report below.
Adjunct faculty teaching asynchronous cloud cybersecurity courses at University of Maryland Global Campus. Mentoring adult learners through pre - built curriculum and real - world security expertise.
Senior incident responder leading cybersecurity investigations and digital forensics for TELUS’s national cyber resilience team. Automating response playbooks and mentoring junior responders.
Security Assurance Specialist supporting customer questionnaires, Trust Center content, and security documentation. Coordinating assurance work across Case IQ’s security, legal, compliance, product, and sales teams.
Penetration Testing Analyst testing Sun Life financial - services applications, APIs, mobile systems, and infrastructure. Supporting vulnerability remediation and foundational Red Team exercises.
Penetration Testing Analyst performing web, API, mobile, and infrastructure security testing at Sun Life. Supporting vulnerability remediation, reconnaissance, and foundational Red Team exercises.
Senior information security advisor securing a large organization’s networks, systems, Azure, and Microsoft 365 environments. Assessing cyber risks, controls, threats, and compliance frameworks.
Senior Cybersecurity Engineer securing Blackline Safety’s worker - safety technology environment. Leading cloud, identity, infrastructure, incident response, and security automation initiatives.
Physical security specialist supporting Sun Life’s financial - services mission through threat intelligence, investigations, and incident analysis. Hybrid role engaging leaders, security partners, and emergency services.
Expert en stratégie numérique d’identité et sécurité chez Beneva, assureur et fournisseur de services financiers. Définit la feuille de route d’authentification, de validation d’identité et de gestion des accès.