Senior Access Management Engineer

Description

The company provides trusted automotive information that helps people buy, sell and own vehicles. It is part of the company and operates brands including CARFAX, automotiveMastermind, Market Scan and Polk Automotive Solutions.

The team focuses on changing the automotive industry, and the work you do helps the wider automotive ecosystem move with more speed and confidence.

The company has been recognised as a top workplace in Virginia, Washington D.C. and St. Louis, and it has earned recognition from the Washingtonian Great Places to Work list.

Responsibilities

• Build, run and harden single sign-on and federation using SAML, OIDC and OAuth 2.0 across enterprise and SaaS applications.
• Own the MFA strategy and its rollout, moving the company toward phishing-resistant options such as FIDO2 and passkeys.
• Design risk-based conditional access and authorization policies, and tune them so they protect access without getting in the way of users.
• Manage workforce identity and, where relevant, customer identity (CIAM) authentication flows.
• Lead the secure onboarding of applications to the access platform, applying consistent policy and least-privilege defaults.
• Set authentication assurance levels and authorization patterns, and document and peer-review every policy change.
• Act as backup owner for a neighbouring domain so that no single person is a point of failure.
• Make sure authentication logs, policy configurations and access decisions feed audit and resilience evidence.

Requirements

• At least 6 years in access management, identity or authentication engineering.
• Deep hands-on experience with at least one access management platform, such as Okta, Microsoft Entra ID, Ping Identity or ForgeRock.
• Strong command of SAML, OIDC and OAuth 2.0 federation.
• Experience designing and operating MFA and conditional access, including modern phishing-resistant methods.
• Ability to turn security requirements into authentication and authorization policy, and to troubleshoot authentication flows, tokens and federation trust in depth.
• Nice to have: experience with customer identity (CIAM) at consumer scale.
• Nice to have: experience with Zero Trust architecture and integrating device trust.
• Nice to have: relevant certifications, such as vendor access management, CISSP or cloud security.
• Nice to have: scripting or automation to manage access policy as code.

Conditions

This is a hybrid role. In-office expectations depend on your location and may change as business needs evolve.

You must be legally authorised to work in Canada at the time of hire. The company cannot offer immigration or work permit support for this role.

The expected annual base salary is $104,000 to $156,000. The exact figure depends on location, experience, skills, qualifications and internal equity.

Pay reflects local market conditions and individual contribution. Beyond base salary, you may be eligible for incentive pay, long-term incentives and a full benefits package, where applicable.

The company is an equal opportunity employer.

Benefits

• Competitive pay, including base salary and incentive opportunities where applicable.
• Health and wellness coverage for you and eligible dependants.
• Retirement savings plans, with company matching where available.
• Full benefit details are on the company's benefits page.