Lead Platform Engineer, Identity & Access

Webflow

3d • $204,800 - $290,000 • Remote

About The Position

Webflow is hiring a Lead Platform Engineer, Identity & Access to own the architecture and roadmap for workforce identity, with Okta as the primary platform. The role will develop Okta into a deliberately architected, governed, and extensible platform, balancing secure-by-default access with a smooth employee experience. The engineer will partner closely with Security to turn policy, risk, and detection requirements into reliable systems, and will work with HR and application owners to improve identity lifecycle management and application integrations.

The role includes governing Okta configuration and changes, automating identity lifecycle processes, establishing standard application onboarding patterns, designing access governance and audit capabilities, and strengthening authentication for people, devices, automations, and AI tools or agents. The position is the top escalation point and primary responder for identity incidents and outages, including on-call coverage for critical identity services. It also manages the Okta vendor relationship, licensing, and costs.

This is a remote-first U.S. role, reporting to the Senior Director, Information Technology. It is full-time, permanent, and exempt. Base salary ranges by U.S. geographic zone are $232,000–$290,000 for Zone A, $217,600–$272,000 for Zone B, and $204,800–$256,000 for Zone C. The role is also eligible for Webflow’s company-wide bonus program.

Requirements

• At least 8 years of experience in identity, platform, or infrastructure engineering, including ownership of a workforce identity platform at meaningful scale.
• Deep hands-on experience architecting an enterprise identity provider; Okta experience is strongly preferred.
• Fluency in SAML, OIDC, OAuth 2.0, and SCIM, including debugging at the token and assertion level.
• Experience with identity governance, including RBAC design, HRIS-driven lifecycle automation, and meeting audit requirements.
• Strong grounding in Zero Trust and identity-based attacks, including device trust and the security of non-human identities.
• Scripting ability in Python, JavaScript, or a similar language, and infrastructure-as-code experience such as Terraform.
• Clear communication with senior and executive audiences, including the ability to drive architecture decisions.

Nice To Haves

• Experience governing identities for AI tools and agents.
• Okta certifications.

Responsibilities

• Own the workforce identity architecture and roadmap, using Okta as the core platform and making build-versus-buy decisions.
• Establish Okta configuration standards, hardening, change control, and configuration as code using Terraform, APIs, Okta Workflows, or scripts where needed.
• Automate the identity lifecycle from joiner to leaver, using the HRIS as the source of truth and SCIM to provision downstream applications.
• Build standard application onboarding patterns, including SSO patterns, provisioning templates, and federated access to cloud and source control platforms.
• Design access governance, including RBAC, least privilege, request and approval workflows, and access reviews; provide access visibility and automated audit evidence.
• Strengthen access controls through phishing-resistant MFA, device trust, risk signals, and governance of non-human identities such as service accounts, tokens, OAuth grants, and AI tools and agents.
• Stream identity telemetry to Security to support detection and response.
• Serve as the top escalation point and primary responder for identity incidents and outages, including on-call coverage for critical identity services, post-incident reviews, and log analysis with Security.
• Manage the Okta vendor relationship, licensing, and costs.
• Influence and collaborate with Security, HR, and application owners; mentor others and set identity engineering standards.

Benefits

• Equity in the form of RSUs for every permanent employee.
• Comprehensive medical, dental, and vision plans for full-time employees and their dependents; Webflow covers most premiums.
• 12 weeks of paid parental leave for all parents and 6 or more additional weeks of paid leave for birthing parents.
• Inclusive care for family planning, menopause, and midlife transitions.
• Flexible vacation, paid holidays, and a sabbatical program.
• Access to mental health resources, therapy, and coaching.
• A 401(k) with 100% employer match up to $6,000 per year in the U.S., and support for retirement savings globally.
• Monthly localized stipends for work and wellness expenses.
• Eligibility for the annual WIN bonus program for full-time, permanent, non-commission employees.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed