AVP, IAM AI Engineer

LPL Financial•San Diego, CA

1d•$122,570 - $204,249•Hybrid

About The Position

LPL Financial is seeking an AVP, IAM AI Engineer to design, operationalize, and automate identity controls for human and non-human actors, with a focus on AI agents and agentic and non-human identities (NHI). This is a hands-on engineering and technical leadership role responsible for building runtime controls, secrets workflows, and governance guardrails that enable safe AI adoption, while establishing and growing a team to sustain and scale the work. The position is embedded in new AI application development from the earliest design stages so identity, authentication, and authorization are built in from the start. The role establishes identity runtime controls and governance throughout the lifecycle of AI agents and other non-human identities, including provisioning, entitlements, credential rotation, certification or attestation, and deprovisioning. It develops secrets-management workflows, fine-grained least-privilege authorization models, and policy-as-code, and establishes reference patterns for user-to-agent, agent-to-agent, and workload-to-service identity flows. The engineer partners with engineering and data science teams on AI applications, supports end-user IAM deployment where required, integrates identity telemetry with SIEM/SOC tooling, and helps monitor and respond to suspicious or compromised credentials. The role also partners with governance, risk, and audit stakeholders to meet regulatory and internal requirements and produce audit evidence, while recruiting, mentoring, and leading a team and setting the technical direction and roadmap for NHI and agentic IAM.

Requirements

At least 5 years of experience in identity and access management or information security, including hands-on engineering.
Demonstrated experience building and/or leading technical teams.
At least 5 years of experience with Ping Identity (PingFederate, PingOne, or PingAccess) or a comparable access-management or federation platform.
At least 5 years of experience with SailPoint (IdentityIQ or Identity Security Cloud) or a comparable identity governance and administration platform.
At least 3 years of experience with Idira (CyberArk, formerly Conjur), HashiCorp Vault, or a comparable secrets-management platform.
Working knowledge of identity and authorization for users and agents, including user-to-agent and agent-to-agent patterns, OIDC and OAuth 2.0/2.1 tokens, and API keys, across authentication and authorization.
Proficiency in a scripting or programming language such as Python; infrastructure-as-code such as Terraform; CI/CD pipelines; and REST API integration.
Experience applying IAM in cloud environments such as AWS, Azure, and/or GCP, and in containerized or Kubernetes workloads.
Bachelor's degree in Computer Science, Information Security, or a related field, or equivalent practical experience.

Nice To Haves

Familiarity with workload-identity and machine-identity standards, including SPIFFE/SPIRE, OAuth token exchange (RFC 8693), mTLS, and cloud workload-identity federation.
Working understanding of AI and agentic systems, including LLMs, agent frameworks, tool-calling, and emerging authentication patterns such as the Model Context Protocol (MCP).
Experience in a regulated industry such as financial services or healthcare, and with associated compliance regimes.
Relevant certifications, such as CISSP, CyberArk Defender/Sentry, SailPoint, Ping, or a major cloud security certification.

Responsibilities

Operationalize and automate identity runtime controls across human and non-human identities, including real-time authentication, authorization, and policy enforcement.
Design, build, and automate lifecycle governance for AI agents and non-human identities, including provisioning, entitlements, rotation, certification or attestation, and deprovisioning.
Develop and automate AI secrets-management workflows, including secret rotation, just-in-time and ephemeral credentials, and secure secret delivery to workloads.
Define and enforce fine-grained, least-privilege authorization models for agents and workloads, using policy-as-code wherever possible.
Establish standards and reference patterns for identity flows in agentic systems, including user-to-agent, agent-to-agent, and workload-to-service authentication and authorization.
Partner with engineering and data science teams on new AI application development to build in identity, authentication, authorization, and secrets handling from the start.
Support deployment and adoption of IAM controls for end users where required.
Integrate identity telemetry with SIEM/SOC tooling; build monitoring and anomaly detection for NHI and agent behavior; support incident response for compromised or misused credentials.
Partner with GRC, risk, and audit stakeholders to ensure controls meet regulatory and internal requirements and to produce audit evidence.
Recruit, build, mentor, and lead a team; set technical direction and the roadmap for NHI and agentic IAM.