Sr. Staff IAM Architect

The role

The Sr. Staff IAM Architect will serve as the design authority for identity across workforce, non-employee, customer, partner, non-human, and AI agent types. This hands-on role involves writing Auth0 Actions, Okta Workflows, and Terraform to build and govern identity architecture.

What you will do

• Own target-state identity architecture across all identity types
• Own Auth0 customer identity architecture end to end
• Keep customer and patient identity plane separate from workforce plane
• Own architecture for consolidating authentication paths onto a single workforce IdP
• Design SSO, SCIM provisioning, and automated deprovisioning patterns
• Define federation and directory architecture across Okta, Entra ID, AWS, and GCP
• Build out Identity Security Posture Management
• Partner with Security Operations and Security Architecture for threat detection and response
• Design access controls that satisfy HIPAA, HITRUST, and SOC 2 requirements
• Serve as the design authority between identity risk and build functions

Required qualifications

• 8+ years in identity and access management, security engineering, or platform architecture
• At least 3 years at a staff, principal, or architect level
• Deep, hands-on customer identity experience
• Designed and delivered a CIAM platform end to end on Auth0, including tenant and organization modelling, MFA, and machine-to-machine authentication
• Strong command of federation and authentication protocols: SAML, OIDC, OAuth 2.0, SCIM, WebAuthn and FIDO2
• Enterprise workforce IdP architecture experience, on Okta or equivalent, including migrations off legacy or fragmented authentication sources
• Demonstrated ability to set architectural direction and get engineering teams to adopt it without direct authority
• Clear written communication, including architecture decision records and reference designs

Nice to have

• Designing for HIPAA and PHI safeguards, or comparable regulated-industry access requirements
• Identity governance depth: joiner-mover-leaver lifecycle, RBAC, access certification, segregation of duties
• Experience with SailPoint ISC and NERM or comparable IGA and non-employee lifecycle platforms
• Cloud PAM and zero standing privilege models, particularly Britive or similar just-in-time access tooling
• Cloud-native identity across AWS, GCP, and Azure, including migrations off cloud-provider user pools such as AWS Cognito, or off social and directory sign-in such as Google Sign-In
• Building Identity Security Posture Management or identity threat detection capability, including SIEM integration for identity telemetry
• Non-human identity, service account governance, secrets management, or AI agent identity
• Infrastructure as code for identity, including Terraform
• HITRUST, SOC 2, or SOX access controls
• Certifications such as CISSP or CISSP-ISSAP, CISM, TOGAF or SABSA, Okta Certified Consultant or Architect, Auth0, SailPoint, or a professional-level cloud architect certification

Benefits

• Medical, Dental, and Vision plans
• Flexible Spending/Health Savings Accounts
• Flexible PTO
• 401(k) + Company Match
• Life Insurance
• Pet insurance

About the company

OpenLoop provides telehealth support solutions designed to streamline and simplify go-to-market care delivery for companies offering virtual support to patients across 50 states. The company has a relatively flat organizational structure with core values of Autonomy, Competence and Belonging.