Senior Identity Platform Engineer (Okta, passkeys and identity verification)

Description

The company is a fast-growing AI infrastructure business, and this role helps decide how global AI capacity is planned and deployed.

You will deliver the company's passkey rollout and make Okta the single front door for staff sign-in, with identity infrastructure managed as code.

You will work alongside an existing Staff Okta engineer, who remains the senior technical voice on Okta. This is a hands-on delivery role with day-to-day ownership of Okta Workforce Identity.

A second, execution-focused opening covers privileged access across the identity control plane. It works with Identity, Endpoint, Security Data, Network Security, Platform Engineering, IT and service owners to turn privileged access into an engineering mechanism, because standing privilege is one of the highest-risk patterns in a fast-growing infrastructure company.

Responsibilities

• Own Okta Workforce Identity day to day, covering sign-on and authentication policies, device assurance, admin roles, groups and SAML, OIDC and SCIM app integrations.
• Bring Okta configuration under Terraform, with peer review, testing and staged releases.
• Build joiner, mover and leaver automation from Workday into Okta using Okta Workflows and APIs.
• Support federation between Okta and Auth0 so staff can reach customer platforms.
• Lead the move to passwordless sign-in: roll out device-bound passkeys and Okta FastPass to everyone, use FIDO2 hardware keys where mandated, and enforce policies group by group until no one can sign in with a password.
• Design account recovery so access is restored through identity verification, not a help-desk reset or a link sent to a personal inbox.
• Integrate an identity verification service that checks government ID and runs a liveness check into onboarding and account recovery.
• Make sure the first passkey and every recovery starts from a verified identity.
• Build privileged access workflows across SaaS admin roles, production, cloud consoles, infrastructure management, source control, data platforms, endpoint admin and emergency access paths.
• Design request, approval, justification, time-bound elevation and automated revocation, and reduce reliance on permanent admin rights in high-risk environments.
• Create a privileged access baseline covering who approves, what justification is needed, how long access lasts, what evidence is kept and how revocation works. Own exception governance for paths that cannot yet meet it.
• Reduce entitlements and stale privilege through automation, and keep clean audit trails for critical systems.
• Design break-glass standards, ownership, monitoring and recovery procedures, then test emergency access and validate readiness.
• Build a tiering model for Tier 0 and Tier 1 systems, admin paths, sensitive groups, service-owner roles and high-risk workflows, and remediate the top 10 highest-risk standing privileges.
• Define privileged access telemetry for detection, investigation, audit, compliance and executive reporting, and work with Security Data on detections and source health.
• Track standing privilege reduction, JIT adoption, stale admin cleanup, break-glass test success, approval SLA and access review closure, and maintain an inventory of top admin paths with owners, approvers, methods, logging, expiry and risk.

Requirements

• 5+ years in identity or platform engineering, including at least 2 years running Okta in production at scale.
• Hands-on experience rolling out passwordless sign-in with FIDO2/WebAuthn, passkeys, Okta FastPass or similar, including recovery design.
• Experience with Okta Workflows, Okta APIs and SCIM, plus Terraform's Okta provider or similar configuration-as-code tools.
• Experience with HR-driven provisioning, ideally from Workday.
• Scripting in Python, Go or similar, and working knowledge of Git and code review.
• Experience integrating identity verification services such as Persona, Incode, iProov, Nametag or similar.
• Experience with Auth0.
• Google Workspace administration experience.
• 7+ years in identity security, privileged access, security engineering, infrastructure security or related engineering roles.
• Hands-on experience designing or running privileged access, JIT, break-glass, access request, approval or access review workflows.
• Strong grasp of authentication, authorization, RBAC, SSO, MFA, access governance, admin tiering and least privilege.
• Experience automating access workflows, entitlement cleanup, evidence collection or revocation.
• Strong scripting, workflow automation, API integration or platform engineering skills.
• Ability to turn access risk into practical controls that engineering and operations teams will adopt.
• Ability to work across enterprise systems, production, SaaS platforms, IT, infrastructure and compliance stakeholders.
• Experience with service accounts, non-human identities, workload identities, API tokens, automation accounts or secrets governance.
• Experience securing production access, source control administration, data platforms, cloud administration or endpoint admin workflows.
• Experience designing access evidence for audit, customer assurance or incident response.

Conditions

The base salary range is $160,000 - $210,000 USD. Actual pay may vary with skill set, experience, education and location.

Performance reviews take place every 12 months.

The role may also be eligible for bonus, equity and/or commission programs.

Work is flexible: you set your own day around life's commitments, with autonomy to deliver.

The company encourages applications from people of colour, LGBTQ+ people, disabled people, neurodivergent people, parents, carers and people from lower socio-economic backgrounds, and will make accommodations on request.

Benefits

• Competitive US compensation covering base pay, bonus and equity.
• Medical, dental and vision coverage.
• Flexible paid time off and parental leave.
• Retirement plan participation.
• A progression plan that can grow into leading cross-functional initiatives and shaping capital strategy, with full support from the company.