Security Engineer II - Identity and Access Management

Marqeta, Inc.; British Columbia; On-site; CAD 104,000 - 130,000; Full time

Benefits offered by this job

Health insurance options

Remote work stipend

Equity in a publicly-traded company

Annual development stipend

Parental leave benefits

Job summary

Marqeta, Inc. in Canada seeks an experienced Security Engineer II to design and operate IAM in cloud-native environments, with emphasis on Okta SSO, PAM, and governance across AWS.

You will implement automated IAM workflows and reduce standing access to strengthen security across the platform. You will integrate IAM across AWS services, SaaS, and DevOps pipelines, support SOC 2 and PCI DSS audits, and contribute to runbooks.

Qualifications

• Hands-on IAM experience with Okta, Entra ID, CyberArk, Ping, SailPoint.
• Knowledge of SAML, OAuth2/OIDC and SCIM.
• AWS IAM concepts (roles, policies, federation) and least privilege.
• Scripting skills (Python/PowerShell) to automate IAM operations via APIs.
• Familiarity with AD/LDAP and cloud-based directories.
• Familiarity with NIST, SOC 2, PCI DSS compliance.

Responsibilities

• Configure and maintain Okta SSO, MFA, lifecycle management and policy integrations.
• Manage just-in-time access and PAM policies in cloud platforms.
• Build and improve IGA workflows for least privilege and audits.
• Automate joiner/mover/leaver processes and access reviews via APIs and IaC.
• Onboard applications and cloud accounts withSecurity/DevOps teams and troubleshoot access issues.
• Support SOC 2, PCI DSS audits by providing access evidence and improving controls.
• Document processes and contribute to runbooks; participate in on-call rotation.

Skills

IAM concepts

SAML/OIDC

RBAC / least privilege

Scripting (Python, PowerShell)

Communication

Education

Bachelor’s degree (or higher)

Tools

Okta

Entra ID

CyberArk

Ping

SailPoint

Britive

Lumos

SAML/OIDC

Job description

We’re seeking an experienced Security Engineer II with a strong passion for Identity and Access Management (IAM) and expertise in cloud-native environments, particularly AWS. You'll build, automate and operate our identity security platforms, help shape modern identity solutions, and reduce standing access and manual work across Marqeta's systems and services, which are 100% cloud-based with no data center footprint.

We work Flexible First. This role can be performed remotely anywhere within Ontario or British Columbia, Canada.

Join us in building a secure, scalable, and frictionless IAM program where you’ll play a crucial part in:

• Building our Identity Governance and Administration (IGA) capabilities.
• Implementing & Operating Privileged Access Management (PAM) in a cloud-first (AWS-focused) environment.
• Driving integration of IAM across AWS services, SaaS platforms, and developer/DevOps pipelines.
• Designing identity and access controls to protect AI/ML systems—ensuring secure access to training data, models, and inference APIs.

The Impact You’ll Have

• Configure and maintain Okta SSO, MFA, lifecycle management and policies, including SAML/OIDC app integrations and SCIM provisioning.
• Manage just-in-time access profiles and policies in PAM platforms (such as Britive or CyberArk) for cloud and privileged resources, working with engineering teams to reduce standing privileges.
• Build and improve access request, approval and review workflows in IGA platforms (such as Lumos or SailPoint) to support least privilege and audit readiness.
• Automate joiner, mover and leaver processes and access reviews using scripting, APIs and infrastructure-as-code.
• Partner with Security, DevOps and Infrastructure teams to onboard applications and cloud accounts and to troubleshoot access issues.
• Support SOC 2, PCI DSS and other audit activities by producing access evidence and improving control design.
• Document processes, contribute to team runbooks, and take part in [on-call rotation, if applicable].

Who You Are

• A minimum of 3 years related experience with a Bachelor’s degree; or 2 years and a Master’s degree; or equivalent combination of related education and work experience.
• Hands-on experience with IAM tools (e.g., Okta, Entra ID, CyberArk, Ping, SailPoint).
• Working knowledge of SAML, OAuth2/OIDC and SCIM.
• Working knowledge of AWS IAM concepts (roles, policies, federation), plus an understanding of least privilege and RBAC.
• Hands-on scripting skills (e.g., Python, PowerShell) to automate IAM operations through APIs.
• Familiarity with directory services such as Active Directory, LDAP, and cloud-based alternatives.
• Familiarity with compliance frameworks such as NIST, SOC 2 and PCI DSS.
• Clear communication skills and the ability to collaborate with engineers and non-technical stakeholders.

Nice-To-Haves

• Relevant certifications or IAM-specific credentials (e.g., CIAM/CAMS, CyberArk Certified, Okta Certified Consultant).
• Experience with AWS technologies such as Lambda, S3, DynamoDB, RDS, Aurora, SNS, SQS, CloudTrail, CloudWatch, Code Pipeline, AWS Developer Tools, and IAM roles and permissions
• Experience with DevOps tools and practices, including secrets management and CICD pipelines

Compensation and Benefits

Marqeta calibrates pay to a competitive value according to working location. When determining salaries, we consider several factors including, but not limited to, skills, prior experience, and work location. The new-hire base salary range for this full-time position, reflected in CAD, is: 104,000 - 130,000.

We also believe in recognizing the contributions of our people. That's why we award annual bonuses to eligible employees, rewarding both individual performance and the success of the entire company.

Along with monetary compensation, Marqeta currently offers:

• Multiple health insurance options
• Flexible vacation time with additional floating holidays
• Retirement savings program with company contribution
• Equity in a publicly-traded company
• Monthly stipend to support our remote work model
• Annual development stipend to support our people growth and development
• Family-forming benefits and generous parental leave base salary top-up

About Marqeta

Marqeta is on a mission to change the way money moves. We’re one of the earliest enablers of embedded finance, a market opportunity sized up in the trillions. Our card issuing platform provides unprecedented flexibility and control for companies to issue cards, authorize transactions, and manage payment operations in real time. Marqeta is powering the most well known brands in the new economy (Block, Cash App, Affir n, Instacart, Doordash, Uber, Walmart, etc). You don’t need to be a Payments expert to join the Marqeta Team, let us help you with that. This is the opportunity of a lifetime to work with innovators around the world and unlock equitable financial access for all.

Marqeta’s Values

Solve for the Customer: With a deep understanding of our customers' business and empathy for their needs, we deliver products and services that drive their success. Earning and keeping their trust guides everything we do.

Do What's Right: Knowing businesses and livelihoods depend on us, we pursue solutions that disrupt responsibly and deliver high-quality results that our customers count on. We own our work from start to finish.

Simplify and Innovate: We approach challenges with curiosity and take smart risks. Innovation comes from finding better, simpler ways to achieve extraordinary outcomes.

Win as a Team: We succeed together by embracing diverse perspectives and pushing each other to raise the bar. We lead with humility and set aside hierarchy to work as a team.

Make it Count: We drive forward with focus and agility. With a sense of urgency and purpose, we get the job done, and done right.

Equal Employment Opportunity, Accommodations and Privacy

Marqeta is an equal opportunity employer committed to an inclusive workplace that fosters belonging. We do not discriminate based on race, color, religion, sex (including pregnancy, lactation, childbirth, or related medical conditions), veteran status or uniformed service member status, age, national origin or ancestry, citizenship or immigration status, physical or mental disability, gender identity, gender expression, sexual orientation, genetic information (including testing or characteristics) or any other characteristic protected by applicable law. We also consider qualified applicants with criminal histories, consistent with legal requirements.

Marqeta endeavors to make reasonable accommodations for applicants with disabilities. If you are an individual with a disability and require a reasonable accommodation to submit this application, complete any pre-employment testing, or otherwise participate in the employee selection process, please submit this form with your specific accommodation request.

Marqeta cares about your privacy. Personal data that is provided as part of the application and recruitment process is processed in accordance with the Applicant Privacy Notice. Additional information for California residents can be found here.

To keep our interview process fair and consistent, we ask that all candidates join video interviews with their camera on.

Notice on Use of AI in Recruitment

We may use artificial intelligence (AI) tools in our recruitment processing consistent with the requirements of applicable laws. For more information, review our AI notice here.