- Company Name
- Deliveroo
- Job Title
- Staff Security Engineer, IAM
- Job Description
-
**Job Title**: Staff Security Engineer, IAM
**Role Summary**
Lead the design, implementation, and evolution of the organization’s Identity & Access Management (IAM) architecture. Deliver secure, scalable, and automated identity solutions across cloud environments, identity providers, and internal systems. Mentor engineers, influence security direction, and ensure IAM practices align with Zero‑Trust and secure‑by‑default principles.
**Expectations**
- Own IAM strategy and governance across multiple identity platforms (Okta, Azure AD, Google Cloud Identity, SailPoint, etc.).
- Design and deliver end‑to‑end identity lifecycle, access control, and privileged access solutions.
- Develop and maintain middleware, automation, and integrations that extend commercial IAM tooling.
- Embed IAM controls into development pipelines, IaC, and cloud IAM governance.
- Serve as a technical subject matter expert and mentor to engineering and security teams.
**Key Responsibilities**
1. **IAM Architecture** –
- Own and evolve IAM stack across identity providers, governance tools, and cloud IAM (AWS, GCP, Azure).
- Design scalable authentication, authorization, provisioning, deprovisioning, RBAC/ABAC, JIT, and privileged access models.
- Lead implementations of identity governance processes (certifications, SoD, policy enforcement).
- Create and promote “Paved Road” guidelines for IAM best practices.
2. **Security Engineering & Integration** –
- Build custom integrations between IAM platforms and internal systems (REST, SCIM, webhooks, event‑driven).
- Develop middleware for edge cases and automate group/role management.
- Extend commercial IAM APIs with event‑driven services and workflow orchestration.
3. **Automation** –
- Implement automation layers in Go, Java, Python, or JavaScript to reduce manual effort.
- Embed IAM controls into CI/CD pipelines and IaC workflows.
4. **Cloud & Platform Security** –
- Design and review IAM roles, policies, and trust boundaries in cloud environments.
- Support Zero‑Trust and secure‑by‑default principles across infrastructure and applications.
5. **Technical Leadership** –
- Mentor engineers on secure design, IAM protocols, and security best practices.
- Partner with GRC, IT, and product teams to balance risk and developer experience.
- Influence organization‑wide adoption of secure authentication, authorization, and access governance.
**Required Skills**
- 7+ years in software or security engineering.
- Proficiency in at least one modern language (Go, Java, Scala, Python, or JavaScript).
- Deep experience designing/operating IAM systems in cloud‑first environments (AWS, GCP, Azure).
- Expertise in authentication/authorization protocols: SAML, OAuth2/OIDC, SCIM, MFA, modern identity assurance.
- Hands‑on experience with identity providers (Okta, Azure AD, Google Identity) and governance tools (ConductorOne, SailPoint IdentityNow).
- Knowledge of cloud IAM fundamentals: roles, policies, trust boundaries.
- Strong automation mindset (REST/SCIM integrations, event‑driven architectures, CI/CD IAM).
**Required Education & Certifications**
- Bachelor’s degree in Computer Science, Information Technology, or related field (or equivalent experience).
- Relevant certifications (e.g., CISSP, CISA, CISM, OSA, or cloud‑specific IAM certifications) preferred but not mandatory.