Security Software Engineer, IAM

Vercel

3h•$208,000 - $312,000•Hybrid

About The Position

Vercel is seeking a Security Software Engineer, IAM, to build identity and access management infrastructure as software rather than administer identity products. The role is suited to a software engineer with deep identity expertise or an IAM engineer with a strong engineering background. You will own identity and IAM end to end, replacing approval queues with self-serve, time-bound, and provable access. Identity should be defined as code, reviewed in pull requests, deployed through CI, and observable in production. You will also help determine how agents act on behalf of users and systems. This is a hybrid role based in San Francisco or New York City, with three days per week in the office. Vercel describes itself as an agentic infrastructure company that helps people and agents ship and run software. Its products are built in the open and are trusted by OpenAI, PayPal, Ramp, Supreme, and millions of developers worldwide.

Requirements

7+ years building and owning identity, access management, or platform security systems, including IAM design across corporate environments (Okta or equivalent) and production environments (AWS or GCP).
Experience building and operating production services or self-service platforms in TypeScript/Node.js, Go, or Python, including REST APIs.
Protocol-level implementation experience with OAuth2, OpenID Connect (OIDC), Security Assertion Markup Language (SAML), and System for Cross-domain Identity Management (SCIM), including failure modes such as token replay and sync drift.
Experience managing IAM infrastructure as code in Terraform.

Nice To Haves

Led a Terraform migration for IAM or identity infrastructure at scale.
Designed or built a JIT access system or access governance platform.
Designed delegation or scoped-credential models for agents or service identities.

Responsibilities

Migrate Okta and related IAM configuration to Terraform so identity changes are reviewed, tested, and versioned, and help engineering teams adopt infrastructure as code.
Build a self-serve access platform, including just-in-time (JIT) access, that enables team and system owners to define, request, and time-bound access.
Own provisioning, deprovisioning, and access review workflows that automatically generate System and Organization Controls 2 (SOC 2) audit evidence.
Unify corporate IAM, including employee identity, SaaS access, and devices, with production IAM, including service accounts, infrastructure permissions, and on-call access.
Enforce least-privilege access across cloud, SaaS, and production infrastructure.
Define and build how agents request and hold access, working with the Accounts team on product-facing identity.