Lead IAM Architect

DRW•Chicago, IL

8h•$150,000 - $200,000

About The Position

DRW is a diversified trading firm with over 3 decades of experience bringing sophisticated technology and exceptional people together to operate in markets around the world. We value autonomy and the ability to quickly pivot to capture opportunities, so we operate using our own capital and trading at our own risk. Headquartered in Chicago with offices throughout the U.S., Canada, Europe, and Asia, we trade a variety of asset classes including Fixed Income, ETFs, Equities, FX, Commodities and Energy across all major global markets. We have also leveraged our expertise and technology to expand into three non-traditional strategies: real estate, venture capital and cryptoassets. We operate with respect, curiosity and open minds. The people who thrive here share our belief that it’s not just what we do that matters–it's how we do it. DRW is a place of high expectations, integrity, innovation and a willingness to challenge consensus. The IAM Team is a net-new, vanguard group responsible for transitioning DRW away from an organically grown identity infrastructure to a unified, enterprise-grade identity platform. We are seeking a Lead IAM Architect to serve as the technical visionary for this modernization effort. You will design the overarching architectural blueprint that successfully decouples AuthN from AuthZ. By bridging commercial IdPs with our highly complex, proprietary trading systems, you will ensure a secure transition from legacy cookie-based sessions to modern zero-trust token exchange.

Requirements

Deep architectural expertise in modern identity protocols (OIDC, OAuth 2.0, SAML) and applied cryptography (JWT, JWKS, RS256).
Proven background as a software or systems engineer. Must be highly proficient in IaC and at least one programming language (Go and/or Python preferred) to build custom glue-code and SDKs.
Deep understanding of modern machine identity paradigms, including HashiCorp Vault, AWS IAM Roles, OIDC federation for CI/CD pipelines, and ephemeral certificate brokering.
Exceptional ability to manage non-engineering and security stakeholders. You must be able to push back on vendor fluff, negotiate architectural compromises with stubborn engineering teams, and explain complex identity risks to executive business stakeholders.
Proven experience untangling legacy technical debt, with a pragmatic approach to using Identity-Aware Proxies (IAPs) as "Last-Mile Adapters" during large-scale migrations.
Strong system design background with the ability to draw and defend architectures that earn the respect of senior software engineers in a high-speed trading culture.
Strategic mindset with the ability to navigate ambiguity and map technical identity solutions directly to regulatory/compliance requirements.

Responsibilities

Design and own the migration architecture to transition DRW from existing identity solutions to a modern, enterprise IdP. You will lead by doing – writing code, configuring APIs, and building proof of concept integrations.
Act as the primary technical authority during vendor evaluations, designing "messy data" Proof of Concepts to rigorously pressure-test commercial IdP and IGA tools against our actual infrastructure.
Design the zero-trust token exchange architecture for internal APIs and microservices, ensuring non-human identities are governed securely.
Act as the technical diplomat between security, compliance, business, and internal engineering teams. You must translate regulatory and security risks into pragmatic engineering requirements that do not slow down the business.
Partner with the internal engineering and security teams to ensure the new enterprise IdP seamlessly feeds identities into custom-built internal applications.