Security Engineer II – Identity and Access Management

This is a fully remote position, open to applicants in Canada.

📋 Description

• Develop, automate, and manage identity security platforms.

• Design contemporary identity solutions to minimize standing access and manual tasks within Marqeta’s cloud-based systems and services.

• Establish Identity Governance and Administration functionalities.

• Implement and oversee Privileged Access Management in a cloud-first environment focused on AWS.

• Propel IAM integration across AWS services, SaaS platforms, and developer/DevOps pipelines.

• Create identity and access controls for AI/ML training data, models, and inference APIs.

• Set up and maintain Okta SSO, MFA, lifecycle management, policies, SAML/OIDC application integrations, and SCIM provisioning.

• Administer just-in-time access profiles and policies in PAM platforms such as Britive or CyberArk.

• Develop and enhance access request, approval, and review workflows in IGA platforms like Lumos or SailPoint.

• Automate joiner, mover, and leaver processes and access reviews utilizing scripting, APIs, and infrastructure-as-code.

• Collaborate with Security, DevOps, and Infrastructure teams to onboard applications and cloud accounts while troubleshooting access issues.

• Assist with SOC 2, PCI DSS, and other audits by generating access evidence and refining control design.

• Document procedures, contribute to team runbooks, and participate in on-call rotation if necessary.

⛳️ Requirements

• A minimum of 3 years of relevant experience with a Bachelor's degree; or 2 years with a Master's degree; or an equivalent combination of relevant education and work experience.

• Practical experience with IAM tools such as Okta, Entra ID, CyberArk, Ping, and SailPoint.

• Proficient understanding of SAML, OAuth2/OIDC, and SCIM.

• Familiarity with AWS IAM concepts, including roles, policies, and federation.

• Knowledge of least privilege principles and RBAC.

• Proficient in scripting, including Python or PowerShell, to automate IAM operations via APIs.

• Acquainted with Active Directory, LDAP, and cloud-based directory alternatives.

• Understanding of NIST, SOC 2, and PCI DSS compliance frameworks.

• Relevant certifications or IAM-specific credentials are advantageous, such as CIAM/CAMS, CyberArk Certified, and Okta Certified Consultant.

• Familiarity with AWS technologies like Lambda, S3, DynamoDB, RDS, Aurora, SNS, SQS, CloudTrail, CloudWatch, CodePipeline, AWS Developer Tools, and IAM roles and permissions is a plus.

• Experience with DevOps tools and practices, including secrets management and CI/CD pipelines, is a bonus.

• Excellent communication skills with the ability to collaborate effectively with engineers and non-technical stakeholders.

🏝️ Benefits

• Various health insurance plans available.

• Flexible vacation policy along with additional floating holidays.

• Retirement savings plan with company contribution.

• Equity in a publicly traded company.

• Monthly stipend to facilitate a remote work model.

• Annual development budget to support personal growth and development.

• Family-forming benefits.

• Generous parental leave base salary top-up.

• Annual bonuses for eligible employees.