Sr. Staff IAM Engineer (Architect)

About The Role

OpenLoop’s mission is to bring care anywhere by powering telehealth solutions at scale. Our Identity and Access Management team governs how every person, partner, and system proves who they are and what they can reach.

We are hiring a Sr. Staff IAM Engineer (Architect) to be the design authority for identity across the company: workforce, non-employee, customer, partner, non-human, and AI agent.

That last one is not filler. Service accounts and AI agents are on track to outnumber the people we govern, and very few companies have a real architecture for them yet. You would own ours.

The platforms are chosen and in flight. Okta is our workforce IdP. SailPoint ISC and NERM are deploying for identity governance and non-employee records. Britive is deploying for privileged just-in-time access. Auth0 is our customer identity platform, procured with machine-to-machine flows in production and the interactive login experience in active build. iam-ops-hub, our identity posture and remediation platform, is built in house and deployed. What we do not have is a single design authority tying them together. Architecture currently gets decided project by project, under delivery pressure. This role exists to change that.

This is a hands-on architecture role, and we mean that concretely. Expect to write Auth0 Actions, Okta Workflows, and Terraform, and to query the posture warehouse yourself. Identity controls here carry HIPAA, HITRUST, and SOC 2 weight. The person who does well in this role is comfortable in ambiguity, writes decisions down, and can explain a design tradeoff to a staff engineer and to a CISO in the same week.

What You’ll Do:

• Own the target-state identity architecture across workforce, non-employee, external, non-human, and AI agent identity types, and set the standards, reference patterns, and decision records that make platform choices consistent rather than improvised per project.
• Own our Auth0 customer identity architecture end to end, including tenant and organization modelling, MFA and phishing-resistant authentication, and machine-to-machine patterns, taking it from partially live to fully architected and governed across our external and partner use cases.
• Keep the customer and patient identity plane deliberately separate from the workforce plane, define the interfaces where the two must meet, and design the external and partner identity models for third-party developers and B2B customers.
• Own the architecture for consolidating our remaining authentication paths onto a single workforce IdP, including the sequencing and patterns our engineers build against.
• Design SSO, SCIM provisioning, and automated deprovisioning patterns for applications handling sensitive data, with audit evidence produced as a byproduct of the design rather than as a manual exercise.
• Define the federation and directory architecture across Okta, Entra ID, AWS, and GCP, including subsidiary and acquisition integration patterns.
• Build out Identity Security Posture Management, extending the posture warehouse and remediation engine we built in house, and define the metrics that tell us whether identity posture is actually improving.
• Partner with Security Operations and Security Architecture to design identity threat detection and response into our existing SIEM rather than a parallel stack.
• Design access controls that satisfy HIPAA, HITRUST, and SOC 2 requirements without adding manual overhead, and keep architecture documentation and control mappings current enough that supporting an audit is a lookup rather than a project.
• Serve as the design authority between the function that surfaces identity risk and the function that builds, so that every finding has a clear architectural path to remediation.

Who You Are:

• An architect who still builds. You would rather write the reference implementation than describe it.
• A writer. You document decisions so they survive your absence, and you would rather be disagreed with in writing than agreed with in a hallway.
• Comfortable owning direction without owning headcount, and effective at getting engineering teams to adopt your patterns because they are good, not because you outrank anyone.
• Energized by finishing half-built things. Much of this estate is in flight, not greenfield.

Required Qualifications

• 8+ years in identity and access management, security engineering, or platform architecture, with at least 3 years at a staff, principal, or architect level.
• Deep, hands-on customer identity experience. You have designed and delivered a CIAM platform end to end, ideally on Auth0, including tenant and organization modelling, MFA, and machine-to-machine authentication.
• Strong command of federation and authentication protocols: SAML, OIDC, OAuth 2.0, SCIM, WebAuthn and FIDO2.
• Enterprise workforce IdP architecture experience, on Okta or equivalent, including migrations off legacy or fragmented authentication sources.
• Demonstrated ability to set architectural direction and get engineering teams to adopt it without direct authority.
• Clear written communication, including architecture decision records and reference designs.

Preferred Qualifications

• Designing for HIPAA and PHI safeguards, or comparable regulated-industry access requirements.
• Identity governance depth: joiner-mover-leaver lifecycle, RBAC, access certification, segregation of duties. Experience with SailPoint ISC and NERM or comparable IGA and non-employee lifecycle platforms.
• Cloud PAM and zero standing privilege models, particularly Britive or similar just-in-time access tooling.
• Cloud-native identity across AWS, GCP, and Azure, including migrations off cloud-provider user pools such as AWS Cognito, or off social and directory sign-in such as Google Sign-In.
• Building Identity Security Posture Management or identity threat detection capability, including SIEM integration for identity telemetry.
• Non-human identity, service account governance, secrets management, or AI agent identity.
• Infrastructure as code for identity, including Terraform.
• HITRUST, SOC 2, or SOX access controls.
• Certifications such as CISSP or CISSP-ISSAP, CISM, TOGAF or SABSA, Okta Certified Consultant or Architect, Auth0, SailPoint, or a professional-level cloud architect certification.
• Digital health, telehealth, or another regulated high-growth environment.

What Success Looks Like:

• A target-state identity architecture approved, published, and adopted, with decision records for every material choice.
• Our customer identity architecture complete, and the interactive login plane delivered to production across external and partner use cases.
• A published consolidation architecture that engineering builds against, with measurable movement of our application portfolio onto a single workforce IdP.
• An Identity Security Posture Management baseline in production: metrics defined and instrumented, continuous drift alerting live, and the highest-severity findings shrinking.
• Audit evidence produced as a byproduct of design, with control mappings traceable directly to architecture documents.