Manager of Identity & Access Management

Reflection • San Francisco, CA

8d • Onsite

About The Position

The Head of Identity and Access Management is responsible for architecting, building, and operating Reflection’s identity infrastructure — the foundational security layer in an environment where the perimeter is entirely identity-based and the threat model includes sophisticated, highly motivated nation-state actors targeting intellectual property, training pipelines, and model weights. This leader will design and operate a bleeding-edge, zero-trust identity architecture that treats identity as software, eliminates static credentials, and protects Reflection’s researchers and massive-scale compute environments without introducing friction.
This is not a traditional enterprise IAM or Active Directory management role. The ideal candidate is a security architect and software engineer in equal measure — capable of mandating hardware-backed phishing-resistant authentication globally, building just-in-time credentialing systems for GPU cluster access, and engineering dynamic, context-aware authorization pipelines that hold up against the most advanced adversary techniques. They bring first-principles cryptographic depth, cloud-native mastery, and the software engineering capability to build custom tooling where commercial solutions fall short.
This is a high-stakes, high-visibility role at the center of Reflection’s security posture. Success requires the ability to build identity infrastructure that is simultaneously state-of-the-art in its security guarantees and genuinely developer-friendly in its design — because at Reflection, security that slows down a researcher is security that has failed.

Requirements

• 15+ years of dedicated experience in identity security, security architecture, or infrastructure engineering within high-growth startups, hyperscale cloud environments, or elite security teams.
• Demonstrated track record of architecting and operating modern, zero-trust identity infrastructure at scale — including hardware-backed authentication, JIT credentialing, and workload identity systems.
• Hands-on experience securing IAM boundaries across major cloud providers (AWS, GCP) and containerized environments, including Kubernetes identity federation and IAM roles for service accounts.
• Practical experience building and operating privileged access management systems for large-scale compute environments, including GPU cluster access in cloud or neocloud contexts.
• Prior experience partnering with detection and response teams to instrument identity telemetry and build adversary-focused detection logic targeting identity-layer attack techniques.
• Deep, first-principles understanding of OAuth 2.0, OIDC, SAML, WebAuthn / FIDO2, and PKI — able to reason from cryptographic fundamentals, not just implement vendor tooling.
• Strong software engineering capability — able to write clean, maintainable code (Go, Python, or Rust) to build custom tooling, API integrations, and automation where commercial solutions fall short.
• Proficiency in Infrastructure as Code (Terraform, Pulumi) for defining and managing identity constructs programmatically.
• Clear, working knowledge of advanced adversary techniques targeting identity, including session token theft, OAuth consent abuse, device registration hijacking, and Golden SAML vectors.
• Demonstrated ability to design identity systems that balance rigorous security guarantees with developer-friendly operational experience — treating usability as a security property, not a trade-off.
• Developer and researcher obsessed — genuinely believes that security is broken if it impedes a researcher’s ability to train a model, and designs systems where the secure path is also the easiest path.
• A bleeding-edge pragmatist — keeps current with the latest developments in the identity and security ecosystem, preferring modern open-source and developer-first tooling over legacy enterprise security suites.
• Resilient and threat-aware — understands that Reflection is a high-value target and constructs identity boundaries with the explicit assumption that individual components will be compromised, designing for resilience rather than relying on perimeter integrity.
• A builder at heart — energized by the challenge of engineering identity infrastructure from scratch in an environment where the stakes are existential and the technical bar is genuinely high.
• Mission-aligned — understands the unique identity security responsibilities of a frontier AI company and approaches the work with the depth of expertise and seriousness of purpose it demands.

Responsibilities

• Design and implement a resilient, cloud-native identity architecture leveraging modern IdPs (Okta, OIDC/OAuth 2.0 federations) unified with edge-enforced zero-trust access networks (Cloudflare Access, Tailscale / WireGuard topologies).
• Architect and continuously evolve the organization’s identity boundary with a first-principles approach — replacing legacy constructs with modern, cryptographically-grounded alternatives at every layer.
• Own the full identity lifecycle architecture across corporate, production, and research environments, ensuring consistency, auditability, and resilience across all access surfaces.
• Mandate and enforce hardware-backed authentication (YubiKeys/WebAuthn) globally across all corporate, production, and research endpoints.
• Eliminate SMS, TOTP, and legacy MFA bypass vectors — driving the organization to a posture where phishing-resistant authentication is the only path.
• Design and operate zero-trust access controls that enforce least-privilege dynamically, incorporating device posture, user context, and behavioral signals into access decisions.
• Build short-lived, just-in-time credentialing systems for engineering and research access to massive GPU clusters across AWS, GCP, and OCI environments.
• Replace SSH keys and long-lived credentials with ephemeral, short-lived certificate-based access via tools like Teleport or HashiCorp Boundary.
• Design and enforce privileged access workflows that give researchers and engineers the access they need — instantly, securely, and with full audit trail — without creating persistent attack surface.
• Architect SPIFFE/SPIRE or cloud-native cryptographic identity frameworks for service-to-service communication across the full workload landscape.
• Ensure machine accounts, training jobs, and CI/CD pipelines use dynamic, short-lived tokens rather than long-lived secrets — eliminating static credential exposure as an attack vector.
• Maintain and evolve workload identity infrastructure as the compute environment scales, ensuring machine identity remains cryptographically sound and operationally reliable at scale.
• Treat authorization policies as code using Open Policy Agent (OPA)/Rego, Cedar, or equivalent frameworks — with full version control, testing, and deployment pipelines.
• Integrate policy evaluation directly into developer workflows and infrastructure deployment pipelines, ensuring authorization is enforced at build time as well as runtime.
• Partner with engineering teams to design access models that make the secure path the path of least resistance — eliminating the developer friction that causes security to be circumvented.
• Build automated provisioning and deprovisioning workflows via SCIM and API-first tooling, ensuring identity lifecycle events are handled with speed, accuracy, and full audit trail.
• Partner with Detection Engineering to instrument identity telemetry and build detection logic targeting anomalous authentication flows, session hijacking attempts, and nation-state adversary tactics.
• Continuously improve automation coverage across the identity stack, reducing manual toil and eliminating the human error surface in identity operations.

Benefits

• Top-tier compensation: Salary and equity structured to recognize and retain our talent globally.
• Stock options: Everyone who joins and contributes to Reflection's success gets to share in the upside through stock options.
• Comprehensive medical, dental, vision, and life, with an annual wellness allowance.
• Lunch and dinner are provided in the office daily.
• 22 weeks paid parental leave for all new birthing and non-birthing parents, including adoptive and surrogate journeys.
• Unlimited paid time off in the U.S. and 30 days in the U.K.
• We sponsor visas to help exceptional talent join our team and support long-term immigration pathways where applicable.
• We have regular off-sites, happy hours, and team celebrations.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed