Principal Cloud Security Engineer, Identity & Access (IAM)

What you'll do

• Set the multi-year IAM architecture and roadmap, including AWS identity, workforce identity, federation, authorization, and secrets management.
• Define secure identity patterns for AI agents and workloads, and embed identity controls into Terraform and CI/CD.
• Partner with engineering, security, and Risk leaders; mentor engineers and advance Zero Trust practices.

What they ask for

• 10+ years in cloud security or IAM, including 3+ years in a staff or architect role owning technical direction.
• Deep AWS IAM expertise, including multi-account Organizations, SCPs, IAM Identity Center, ABAC, and secrets management.
• Enterprise workforce identity experience with Okta or an equivalent platform, including SSO, MFA, SCIM, and lifecycle management.
• Strong knowledge of SAML, OIDC, and OAuth2; Terraform fluency and understanding of identity controls in CI/CD.

Nice to have

• Hands-on work with AI/agentic or non-human identity, or experience with identity-aware proxies, agent observability, or LLM access governance tooling.
• GCP or multi-cloud identity experience; AWS Certified Security – Specialty.

Pay

$184,800 USD - $277,200 USD (base salary); $167,200 USD - $300,000 USD (base salary)

Tools

AWS, AWS Organizations, SCPs, IAM Identity Center, ABAC, AWS Secrets Manager, HashiCorp Vault, Terraform

AI focus

Define how AI agents and service-to-service workloads authenticate, assume roles, and have actions observed and governed; secure AI agents in production.