MTS Lead, Identity and Access Management

The role

The Head of Identity and Access Management will architect, build, and operate identity infrastructure. This role involves designing zero-trust architecture and managing identity lifecycles across corporate, production, and research environments.

What you will do

• Design and implement a resilient, cloud-native identity architecture.
• Architect and evolve the organization's identity boundary.
• Own the full identity lifecycle architecture.
• Mandate and enforce hardware-backed authentication globally.
• Eliminate SMS, TOTP, and legacy MFA bypass vectors.
• Design and operate zero-trust access controls.
• Build short-lived, just-in-time credentialing systems for GPU clusters.
• Replace SSH keys and long-lived credentials with ephemeral certificate-based access.
• Architect SPIFFE/SPIRE or cloud-native cryptographic identity frameworks.
• Treat authorization policies as code using frameworks like OPA/Rego or Cedar.

Required qualifications

• 15+ years of dedicated experience in identity security, security architecture, or infrastructure engineering.
• Track record of architecting and operating modern, zero-trust identity infrastructure at scale.
• Hands-on experience securing IAM boundaries across major cloud providers (AWS, GCP).
• Experience with containerized environments, including Kubernetes identity federation and IAM roles.
• Practical experience building and operating privileged access management systems for large-scale compute environments.
• Prior experience partnering with detection and response teams to instrument identity telemetry.
• Deep, first-principles understanding of OAuth 2.0, OIDC, SAML, WebAuthn / FIDO2, and PKI.
• Strong software engineering capability in Go, Python, or Rust.
• Proficiency in Infrastructure as Code (Terraform, Pulumi).
• Working knowledge of advanced adversary techniques targeting identity.

Benefits

• Top-tier compensation: Salary and equity.
• Stock options.
• Comprehensive medical, dental, vision, and life.
• Annual wellness allowance.
• Lunch and dinner provided in the office daily.
• 22 weeks paid parental leave for all new birthing and non-birthing parents.
• Unlimited paid time off in the U.S.
• 30 days paid time off in the U.K.
• Visa sponsorship support.
• Regular off-sites, happy hours, and team celebrations.

Before you apply

• This position may require access to technology or source code subject to the U.S. Export Administration Regulations.
• Any offer of employment may be conditioned on the Company's ability to provide access to technology or source code in compliance with U.S. export control laws.

About the company

Reflection is a research lab making intelligence open and accessible for everyone to use, customize, and build on. They build open models to help shape the future of AI.