Security Engineer II - Identity and Access Management

Description

The role is for an experienced Security Engineer II who cares about identity and access management and has depth in AWS-based cloud environments.

You will build, automate and run the company's identity security platforms, help shape modern identity solutions, and cut standing access and manual effort across systems that are 100% cloud-based with no data center footprint.

The IAM program covers four areas: identity governance and administration, privileged access management in an AWS-first setup, IAM integration across AWS, SaaS and developer/DevOps pipelines, and access controls that protect AI/ML systems, including access to training data, models and inference APIs.

Responsibilities

• Set up and look after Okta SSO and MFA, lifecycle rules and policies, covering SAML/OIDC app connections and SCIM provisioning.
• Set up just-in-time access profiles and policies in PAM tools such as Britive or CyberArk for cloud and privileged resources, working with engineers to reduce standing privileges.
• Build and improve access request, approval and review flows in IGA tools such as Lumos or SailPoint so access stays least privilege and audit-ready.
• Script and automate joiner, mover and leaver processes and access reviews through APIs and infrastructure-as-code.
• Work with Security, DevOps and Infrastructure teams to onboard applications and cloud accounts and to fix access problems.
• Produce access evidence and improve control design to support SOC 2, PCI DSS and other audits.
• Write process documentation, contribute to team runbooks, and join the on-call rotation where applicable.

Requirements

• At least 3 years of related experience with a Bachelor's degree, or 2 years with a Master's degree, or an equivalent mix of education and work experience.
• Hands-on work with IAM tools such as Okta, Entra ID, CyberArk, Ping or SailPoint.
• Working knowledge of SAML, OAuth2/OIDC and SCIM.
• Working knowledge of AWS IAM concepts (roles, policies, federation), plus an understanding of least privilege and RBAC.
• Hands-on scripting in Python or PowerShell to automate IAM operations through APIs.
• Familiarity with directory services such as Active Directory, LDAP and cloud-based options.
• Familiarity with compliance frameworks such as NIST, SOC 2 and PCI DSS.
• Clear communication, with the ability to work with engineers and non-technical stakeholders.
• Nice-To-Haves: relevant certifications or IAM-specific credentials such as CIAM/CAMS, CyberArk Certified or Okta Certified Consultant.
• Nice-To-Haves: experience with AWS technologies such as Lambda, S3, DynamoDB, RDS, Aurora, SNS, SQS, CloudTrail, CloudWatch, Code Pipeline, AWS Developer Tools, and IAM roles and permissions.
• Nice-To-Haves: experience with DevOps tools and practices, including secrets management and CI/CD pipelines.

Conditions

This is a full-time role that can be done remotely from anywhere in Ontario or British Columbia, Canada.

Pay is set by work location, skills, prior experience and other factors.

The new-hire base salary range for this role, in CAD, is 104,000 - 130,000.

Benefits

• Annual bonuses for eligible employees, based on personal performance and company-wide success.
• Multiple health insurance options.
• Flexible vacation time with additional floating holidays.
• Retirement savings program with company contribution.
• Equity in a publicly traded company.
• Monthly stipend for the remote work model.
• Annual development stipend for learning and growth.
• Family-forming benefits and parental leave with a base salary top-up.