Senior IT Security Engineer

Alloy • New York, NY

7d • Hybrid

About The Position

Alloy is hiring a Senior IT Security Engineer to own workforce identity and access management, including how access is granted, automated, reviewed, and removed. The role is the primary technical expert for Okta, SaaS access, and identity automation, while sharing responsibility for broader IT and Security work in a shared-SME and backup-coverage model. Alloy serves financial institutions and fintechs and maintains ISO 27001 and SOC 2 programs.

The position covers identity lifecycle automation, SaaS integrations, access governance, privileged and non-human identity management, and emerging access controls for AI platforms, agents, and MCP integrations. It also contributes to endpoint security, incident response, documentation, and the IT and Security on-call rotation. The role is hybrid and requires in-person office attendance four days per week: Tuesday through Thursday, plus either Monday or Friday.

Requirements

• Hands-on IT or security engineering experience, with significant responsibility for Okta or a comparable workforce identity provider.
• Experience administering identity-provider groups, access and authentication policies, SaaS application assignments, MFA, and administrative roles.
• Experience implementing and troubleshooting SAML/OIDC SSO, SCIM provisioning, and OAuth-based integrations.
• Experience running employee and contractor identity lifecycles across HR systems, an identity provider, Google Workspace, and downstream SaaS applications.
• Ability to automate access workflows using Okta Workflows, APIs, scripts, or comparable tools.
• Understanding of least privilege, RBAC/ABAC, access reviews, and account lifecycle controls.
• Working familiarity with endpoint security, EDR, DLP, email security, and SaaS security tooling, and willingness to work beyond IAM.
• Strong troubleshooting, documentation, and communication skills in a shared-responsibility IT/Security team.

Nice To Haves

• Experience with temporary privileged access management platforms.
• Experience governing non-human identities, service accounts, API credentials, and OAuth applications.
• Familiarity with identity and delegated access for AI tools, agents, and MCP integrations.
• Experience with ISO 27001 or SOC 2 controls in a fintech, SaaS, or other regulated environment.

Responsibilities

• Serve as the primary technical subject-matter expert for workforce identity and access management, including Okta groups, policies, application assignments, administrator roles, MFA, and authentication controls.
• Manage SaaS access and application onboarding; implement and maintain SAML/OIDC single sign-on integrations, SCIM provisioning and deprovisioning, and Google Workspace access.
• Maintain and improve employee and contractor joiner, mover, and leaver workflows across the HRIS, identity provider, and downstream SaaS applications.
• Use Okta Workflows and other automation to reduce manual access processes.
• Troubleshoot authentication and provisioning issues, administer temporary access and exceptions, and improve the reliability and efficiency of access requests.
• Refine, manage, and evolve role-based and attribute-based access control.
• Mature privileged access management and temporary privileged access management for administrator and production resource access, including just-in-time and temporary access and break-glass procedures.
• Improve ownership and lifecycle controls for service accounts, system users, API credentials and tokens, OAuth applications, bots, and integrations.
• Shape identity and delegated-access controls for AI platforms, AI agents, and MCP integrations, including the access scope available to tools and agents.
• Strengthen least privilege and RBAC/ABAC; conduct access and privileged-access reviews; remediate stale or orphaned accounts; enforce contractor access expiration; and provide IAM evidence for ISO 27001 and SOC 2.
• Contribute to endpoint security, EDR, DLP, application control, email security, SaaS/security tools, and other IT/Security projects within a shared-expertise and backup-coverage model.
• Investigate incidents involving identity, users, endpoints, email, and SaaS; coordinate with teammates and business partners; and maintain clear processes and documentation.
• Participate in the IT and Security on-call rotation, responding to critical alerts and urgent after-hours support requests.

Benefits

• Unlimited PTO and flexible work policy.
• Employee stock options.
• Medical, dental, and vision plans, with an HSA and monthly employer contribution and FSA options.
• 401(k) with 100% match up to 4% of annual employee compensation.
• 16 weeks of paid parental leave for eligible new parents.
• Home office stipend for new employees.
• Annual learning and development stipend.
• Well-being benefits including access to ClassPass, OneMedical, UrbanSitter, and Spring Health.
• Hybrid work environment, with catered lunches and employee-organized cultural events for employees working from the New York City headquarters.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed