Senior Identity Governance Engineer

ServiceTitan•US CA Remote, CA

1d•$125,700 - $201,700

About The Position

ServiceTitan is hiring a Senior Identity Governance Engineer in InfoSec to engineer the governance layer of its identity fabric across cloud environments, SaaS applications, data systems, machine identities, and AI agents. The role designs and automates controls that ensure identities have appropriate access for valid reasons and appropriate durations, with reviewable access and audit-ready evidence. Corporate Engineering and IT administer identity platforms such as Okta and Lumos and run lifecycle operations; InfoSec GRC owns governance policies and the access review program. This engineer defines and implements governance requirements in partnership with those teams and is a key owner of the ISPM and IGA program. The engineer provides governance requirements and design patterns for access requests, authentication and authorization, entitlement models, access reviews, lifecycle assurance, privileged access, and non-human identities. The role administers Veza in collaboration with Corporate Security, Security Architecture, Product Security, and Security Operations, while partnering with Corporate Engineering, IT, and system owners to integrate tools and put governance controls into practice. It also supports compliance and audits by automating evidence collection and translating regulatory requirements into technical controls and workflows. The position calls for deep identity experience combined with hands-on engineering skills, including scripting and API integrations. The successful candidate uses identity analytics to identify and remediate excessive access, dormant or orphaned accounts, identity drift, and other risks, while enabling teams to work securely and efficiently.

Requirements

At least 5 years of experience in identity and access, with depth in Identity Governance & Administration.
Deep understanding of joiner/mover/leaver lifecycle management, RBAC/ABAC and entitlement modeling, Separation of Duties, privileged access governance, and the Principle of Least Privilege.
Ability to design and automate enterprise-scale access certification programs.
Working knowledge of authentication and authorization standards and patterns, including SSO, OIDC, SAML, SCIM, MFA, and RBAC/ABAC, and ability to review enterprise integrations against them.
Proficiency in a scripting language such as Python or Go.
API integration experience and familiarity with workflow or low-code tooling.
Ability to translate regulatory and audit requirements, including SOX ITGC, PCI DSS, SOC 2, and ISO 27001, into identity controls, automated workflows, and audit-ready evidence.
Comfort working directly with internal and external auditors.
Ability to read cloud IAM and secrets management configurations and partner with engineering teams operating those platforms.
Ability to use identity analytics and risk data to identify and prioritize high-risk areas and turn findings into governed remediation.

Nice To Haves

Broader identity and access engineering experience in SSO, provisioning, directory automation, or identity platform automation.
Hands-on experience with modern IGA and identity discovery tools such as Veza, Lumos, and Okta.
Experience administering an authorization graph platform such as Veza.
Proven experience governing non-human identities in cloud-native AWS or GCP environments, including inventory, ownership assignment, rotation and expiry requirements, periodic attestation, and risk exception handling.
Understanding of ISPM principles, including detection of identity drift, excessive entitlements, orphaned accounts, and misconfigurations.

Responsibilities

Define governance requirements and design patterns for access request workflows for privileged systems, including role-based, time-bound, delegated, and just-in-time access.
Measure adoption of governed access request workflows, build monitoring to detect workflow bypass, and validate that implemented workflows work as intended.
Partner with Security Architecture to define authentication and authorization standards for enterprise tools, including SSO, MFA, phishing-resistant requirements, OIDC, SAML, SCIM, and least-privilege role models; review integrations against those standards.
Design authorization decisions and entitlement models based on job functions and privileged data access, including for high-risk systems and entitlements such as ST Admin roles, Snowflake, and Salesforce.
Normalize application entitlement data in Veza so access can be reviewed consistently across systems.
Build and operate tooling and automation for user access reviews supporting SOX ITGC, PCI DSS, SOC 1/2, and ISO 27001 programs owned by InfoSec GRC.
Build joiner/mover/leaver control assurance, including leaver access-reversion evidence, reconciliation against the authoritative HR source, and orphaned-account detection.
Improve visibility into standing privileged access across cloud infrastructure and the data platform, and advance time-bound elevation through PIM and just-in-time access with governed exceptions.
Define the target-state governance architecture across Okta, Veza, and Lumos and the risk-based identity lifecycle it supports.
Administer Veza with partner security teams, developing data-source integrations, policies, and alerts; partner with Corporate Engineering and IT on Okta and Lumos lifecycle and workflow integration.
Extend periodic certifications with continuous identity monitoring and analytics for over-privileged accounts, shadow identities, dormant access, and identity drift; automate remediation workflows with named owners.
Build inventory and governance workflows for service accounts, API keys, personal access tokens, and AI agents, covering ownership, rotation, attestation, and remediation with owning teams.
Ensure AI integrations receive rigorous entitlement management in partnership with the AI governance review process.
Collaborate with Corporate Engineering, Security Architecture, and system owners to integrate enterprise tools with identity by design, while coordinating with InfoSec GRC on governance requirements and control effectiveness.
Provide technical identity evidence for SOX, PCI, ISO 27001, and SOC 1/2 audits, partnering with the SOX IT compliance team and automating evidence collection.
Partner with Corporate Engineering to engage identity vendors including Veza, Okta, and Lumos; hold vendors accountable to commitments and service levels, influence product roadmaps, and obtain implementation and adoption support.

Benefits

Flexible time off and flextime.
Learning and development opportunities, comprehensive onboarding, leadership training, and programs and events.
Recognition through Bonusly and peer-nominated awards.
Company-paid medical, dental, and vision insurance, with 100% employer-paid options and 90% coverage for dependents.
Flexible spending and health savings accounts (FSA and HSA).
401(k) match.
Telehealth options, including One Medical memberships.
Parental leave and support.
Up to $20,000 in fertility services, including IUI and IVF.
Surrogacy and adoption reimbursement.
On-demand maternity support through Maven Maternity.
Free breast milk shipping through Maven Milk.
Pet insurance.
Legal advisory services.
Financial planning tools.
Annual bonus and equity.