Enterprise IAM Security Engineer

Opendoor•Miami, FL

1d•Onsite

About The Position

The Enterprise IAM Security Engineer owns the identity control plane for employees and contractors, designing, building, and operating systems for authentication and authorization. The role sets the technical direction for identity while collaborating with specialists across the broader enterprise security surface. It combines software engineering and automation to strengthen security while enabling teams to work efficiently. The engineer owns workforce passwordless authentication, authentication enrollment and assurance policies, session controls, and per-application policies informed by device posture, network context, and risk signals. The role also manages non-human identities and AI-agent identities, including scoped credentials, delegation, expiry, and auditability. Identity configuration is managed as code and changes are shipped through pull requests. The position builds first-party tooling and integrations that extend commercial identity platforms, supports identity-related detection and incident response, establishes secure-by-default standards for SaaS and AI tools, and mentors colleagues in identity engineering practices. The role is based in one of the company's talent hubs and requires in-office work five days a week, with required attendance Monday, Tuesday, Thursday, and Friday.

Requirements

Proven track record building agentic systems and a strong conviction that AI and automation should eliminate manual work.
Experience designing, building, and operating an enterprise-scale workforce identity platform, with deep hands-on Okta engineering expertise, including automation and API-driven integrations.
Experience shipping an enterprise-scale passkey rollout on Okta and understanding and addressing real-world WebAuthn and FIDO2 adoption challenges.
Experience managing identity infrastructure as code, using Terraform or an equivalent IaC tool, and shipping changes through pull requests.
Strong software engineering ability in Python, Go, or TypeScript, including building first-party tooling and API-driven automation.
Identity-first expertise in SSO, SAML, OIDC, SCIM provisioning, conditional access, and least privilege at scale across employees and contractors.
High autonomy, including setting a roadmap and choosing a direction in ambiguous situations while executing hands-on.
Business-enablement mindset, with success measured by adoption and impact.
Humility and curiosity, with a focus on building guardrails and automation that help other teams move quickly and securely.

Nice To Haves

Hands-on Google Workspace administration and automation, including Admin SDK, directory sync, and DLP, alongside Okta.
Experience connecting device trust or posture signals to access decisions, or with identity-aware proxy patterns.
SOC 2 or SOX access-control evidence experience.
Contributions to open-source identity tooling or the Okta Terraform provider ecosystem.

Responsibilities

Design, build, and operate systems that authenticate and authorize employees and contractors, owning the identity control plane end to end.
Own passwordless workforce authentication, including passkeys, across employee and contractor identities.
Define authentication enrollment rules and assurance requirements by user population.
Design authenticator assurance tiers and session policies, including session lifetime, idle timeout, and step-up re-authentication.
Build per-application authentication policies using device posture, network context, and risk signals, with an exception path for legitimate users.
Own the inventory of service accounts, API keys, and workload identities, ensuring they are tracked, owned, and issued short-lived federated credentials with automatic expiry.
Manage AI agents as a distinct identity class, with scoped single-use credentials, clear delegation, and granular audit trails.
Manage identity configuration as code and review and ship changes through pull requests.
Build first-party tooling to extend commercial identity platforms, including lifecycle automation, access governance workflows, provisioning, and workforce SaaS integrations.
Set identity technical direction, contribute to the broader security engineering roadmap, and deliver critical security infrastructure.
Provide high-fidelity identity telemetry to detection and response pipelines and support incident response involving identity.
Establish secure-by-default standards for new SaaS and AI tools, enforced at the identity layer.
Mentor engineers across security and IT on identity engineering patterns and build reusable automation and guardrails.