Sr. Staff IAM Engineer in Abbeyville, Colorado at Jobgether

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Sr. Staff IAM Engineer (Architect) based in the United States.

This is a hands-on architecture leadership role responsible for defining the future of identity across workforce, customer, partner, non-employee, non-human, and AI-agent identities. You will serve as the design authority connecting multiple identity, governance, privileged-access, and security platforms into a cohesive enterprise architecture. The role combines strategic architecture with hands-on engineering, including Auth0 Actions, Okta Workflows, Terraform, and identity posture analysis. You will shape customer and partner identity, workforce authentication consolidation, federation, provisioning, and identity security posture management. Your work will directly support environments governed by HIPAA, HITRUST, and SOC 2 requirements. This is an opportunity to establish architecture standards and reference patterns while influencing engineering teams without relying on formal authority. You will thrive in an environment where platforms are already being deployed and the priority is to bring consistency, governance, and long-term direction to an evolving identity ecosystem.

• Own the target-state identity architecture across workforce, non-employee, external, non-human, and AI-agent identities, establishing standards, reference architectures, and architecture decision records that create consistency across projects.
• Lead the end-to-end customer identity architecture, including tenant and organization models, MFA, phishing-resistant authentication, machine-to-machine authentication, and external and partner identity use cases.
• Define clear separation between customer/patient identity and workforce identity, while designing the interfaces and federation models required between them.
• Establish the architecture and migration patterns required to consolidate application authentication onto a unified workforce identity provider.
• Design SSO, SCIM provisioning, automated deprovisioning, and lifecycle-management patterns for applications handling sensitive information, ensuring audit evidence is generated through the architecture itself.
• Define federation and directory strategies across Okta, Entra ID, AWS, and GCP, including repeatable approaches for subsidiaries, acquisitions, and other organizational changes.
• Build and evolve Identity Security Posture Management capabilities, extending an existing identity posture and remediation platform while defining meaningful metrics for identity risk and improvement.
• Partner with Security Operations and Security Architecture to integrate identity threat detection and response into the existing SIEM and broader security ecosystem.
• Design access controls aligned with HIPAA, HITRUST, and SOC 2 requirements while minimizing manual operational effort and maintaining current architecture documentation and control mappings.
• Act as the architectural bridge between identity-risk discovery and engineering remediation, ensuring findings have clear, scalable paths to resolution.
• Establish and communicate architectural direction through reference implementations, technical standards, and written decision records that engineering teams can adopt without direct reporting authority.
• Drive measurable outcomes, including adoption of the target-state architecture, customer identity maturity, workforce identity consolidation, identity posture improvements, and audit readiness.

• 8+ years of experience in identity and access management, security engineering, platform architecture, or a closely related discipline, including at least 3 years at staff, principal, architect, or equivalent seniority.
• Deep hands-on customer identity and access management experience, ideally including end-to-end CIAM architecture and delivery using Auth0 or a comparable platform.
• Strong expertise with SAML, OIDC, OAuth 2.0, SCIM, WebAuthn, and FIDO2, with the ability to apply these protocols to enterprise authentication and federation architectures.
• Proven experience designing enterprise workforce identity architectures using Okta or an equivalent identity provider, including migrations away from legacy or fragmented authentication systems.
• Demonstrated ability to establish architectural direction, influence engineering teams, and drive adoption without relying on formal organizational authority.
• Strong written communication skills, including experience producing architecture decision records, reference designs, technical standards, and other durable documentation.
• A builder mindset, with the ability and willingness to implement identity solutions rather than operating solely at a conceptual or advisory level.
• Experience working effectively in ambiguous environments where systems and platforms are already in flight and require architectural consolidation and completion.
• Experience with regulated or security-sensitive environments is highly valuable, particularly HIPAA, PHI safeguards, HITRUST, SOC 2, or SOX access controls.
• Strong identity governance knowledge, including joiner-mover-leaver processes, RBAC, access certifications, segregation of duties, and non-employee lifecycle management. Experience with SailPoint ISC, NERM, or comparable IGA platforms is a plus.
• Experience with cloud PAM, just-in-time access, and zero-standing-privilege models, particularly Britive or similar technologies.
• Knowledge of cloud-native identity architectures across AWS, GCP, and Azure, including migrations away from cloud-provider user pools or social and directory-based authentication.
• Experience building Identity Security Posture Management or identity threat-detection capabilities, including integration of identity telemetry with SIEM platforms.
• Familiarity with non-human identity, service-account governance, secrets management, and emerging AI-agent identity models.
• Experience using infrastructure as code for identity, particularly Terraform.
• Relevant professional certifications such as CISSP, CISSP-ISSAP, CISM, TOGAF, SABSA, Okta certifications, Auth0 or SailPoint certifications, or professional-level cloud architecture certifications are advantageous.
• Experience in digital health, telehealth, or another regulated, high-growth environment is preferred.
• Ability to work autonomously, communicate clearly with both technical and executive stakeholders, and build trust through sound technical judgment and well-documented decisions.

• Medical, dental, and vision insurance plans.
• Flexible Spending Accounts and Health Savings Accounts.
• Flexible paid time off.
• 401(k) retirement plan with company matching.
• Life insurance.
• Pet insurance.
• A relatively flat organizational structure that encourages autonomy, ownership, and direct contribution.
• An environment where employees are encouraged to bring forward ideas, influence decisions, and make meaningful improvements.
• A culture centered on autonomy, competence, and belonging.