Senior Security Engineer, Identity and Access Management

HackerOne is a global cybersecurity company focused on continuous threat exposure management and AI-powered security solutions. The Senior Security Engineer, Identity and Access Management will design and operate identity lifecycle automation, access models, identity-as-code systems, and AI-powered access governance for human and non-human identities. The role also partners with engineering, IT, and compliance teams on identity controls, measurement, detection, and incident response.

Responsibilities:

• Own the identity lifecycle end to end, from onboarding and creation through change to removal, for people, service accounts, and AI agents alike, building the automation that grants entitlements on evidence of legitimate need and removes them seamlessly and automatically
• Design and build the access models on top of data classification, so that what an identity can reach follows from what the data is rather than from who asked
• Make time-bound access the default for critical data, so that the secure path is the easy path
• Engineer identity as code, keeping provisioning logic, entitlement policy, and access review rules in version control and under test across systems such as Okta, Lumos, and AWS IAM, applying First Principles Problem Solving rather than configuring by hand in consoles
• Build AI and LLM-powered tooling that makes access review and entitlement anomaly detection continuous rather than periodic, embedding AI First practices so unusual patterns surface when they happen rather than at audit, and decide where AI is trusted to carry an access decision and where a person still signs it off
• Bring non-human identities under the same discipline as human ones. Service accounts, workload identities, integrations, and AI agents each get an owner, a purpose, and an expiry, treated as the default rather than a cleanup project
• Continuously measure access and report the opportunity to reduce unnecessary entitlement, using Data-Driven Decision Making to prioritize where reduction matters most
• Partner with Engineering, Enterprise IT, and Compliance to embed identity controls into the systems they own, and support detection and incident response as the identity responder, containing access, reconstructing what an identity reached, and contributing to blameless retrospectives, demonstrating Change Agility as threats and tooling evolve

Requirements:

• 5+ years of experience in identity and access management, security engineering, or software engineering with substantial ownership of identity systems
• Hands-on experience operating an enterprise identity provider such as Okta, including SAML, OIDC, SCIM, and lifecycle automation
• Experience managing identity across an enterprise SaaS estate such as Google Workspace, Salesforce and Workday, including SCIM provisioning and group-driven entitlements
• Experience with cloud IAM, ideally AWS, including policy design and short-lived credentials
• Strong software engineering fundamentals with proficiency in Python, Go, or a similar language, and hands-on use of AI and LLM tooling and agentic coding tools in production engineering work
• Identity work in a regulated sector such as financial services, healthcare, or government, and producing access control evidence for audit against requirements such as PCI DSS, HIPAA, SOC 2, or ISO 27001
• Managing identity infrastructure as code, and access request or governance tooling, for example Terraform and Lumos
• Mobile device management (MDM) alongside identity, for example Kandji integrated with Okta: device trust policies, platform SSO, and endpoint enrollment
• Non-human, workload, and privileged access: secrets management, short-lived credentials, and service-to-service authentication
• Building AI or LLM-powered tooling for security or identity workflows
• Detection and incident response for identity-centered incidents such as credential compromise, session abuse, or entitlement misuse
• Industry certification in identity or security, such as IDPro CIDPRO, Okta certifications, AWS Certified Security – Specialty, or CISSP