Senior IAM Engineer

Aiven; Helsinki; Hybrid; EUR 90,000 - 130,000; Full time

Benefits offered by this job

Equity plan

Hybrid work policy

Equipment for success

Professional development budget

Wellbeing support

Time off commitment (Parental & Sick)

Job summary

Aiven seeks a Senior IAM Engineer to own identity lifecycle end to end, from HRIS through Okta to downstream apps. You’ll build automation in Okta Workflows, manage machine identities, and govern access at scale while partnering with Engineering, IT, People Ops, and Security Operations.

This role emphasizes ownership, automation, and secure, auditable access across a multi-cloud environment. Join a global Security & Compliance team driving identity strategy, AI-enabled automation, and scalable

Qualifications

• Five or more years in IAM, identity engineering, or a closely related security discipline.

Responsibilities

• Identity lifecycle and onboarding/offboarding from HRIS through Okta to apps.
• Identity automation in Okta Workflows and HRIS as source of truth.
• Extend IAM to machine identities (service accounts, bots, AI agents).
• Own access requests and approvals, ensuring efficient and auditable controls.
• Build self-service access and per-role access policies.
• Onboard applications to SSO and automate provisioning; design RBAC.
• Security reviews of integrations and cross-functional collaboration; provide identity evidence for PCI, SOC 2, and ISO 27001.

Skills

IAM engineering

Automation

Cloud IAM

IaC (Terraform)

Onboarding/offboarding

Access governance

Python/JS automation

Tools

Okta

Terraform

Jira

Job description

We’re a global team of over 400 people, working together to push the boundaries of open-source technology and multi-cloud solutions. Our vision is to help developers, builders, and creators bring their ideas to life with speed and simplicity, by providing a cloud data platform that makes open-source databases, search, streaming, and application infrastructure easily accessible to everyone.

You'd be joining an experienced and highly-engaged Security & Compliance team, working closely with Product Security, Security Operations, and Compliance. Identity touches every part of the org, so you'd have real influence over the roadmap and trajectory of Security more broadly, not just IAM. You'd be collaborating with people across the globe, with plenty of opportunity to grow your skillset across a genuinely multi-cloud footprint.

The Role:

We are seeking a proactive and detail-oriented Senior IAM Engineer to join our Security team.
Identity is the control plane for Aiven. Every employee, service, and automation reaches our systems through it, which makes identity and access management the determining factor in ensuring access is efficient, audited, and controlled.

In this role you will own identity and access management end to end: the joiner-mover-leaver lifecycle flowing from our HRIS system through Okta to every downstream application, the access request and review processes that keep entitlements defensible, and the automation that sustains both without manual intervention. You will be the reference point and partner for Engineering, IT, People Operations, and Security Operations on any question concerning who can access what, and on what basis.

You'll work at the center of a wide cross-functional web - partnering closely with Engineering, IT, People Operations, and Security Operations, and acting as the go-to voice on identity for the broader Security & Compliance org. Day to day, you'll live in Okta as your core platform, orchestrating lifecycle automation through Okta Workflows, managing access requests and approvals via Jira, and integrating identity across a growing set of enterprise SaaS tools, major cloud providers (AWS, GCP, Azure), and internal systems. It's a role with real technical range and ownership - you'll move between platform administration, AI integration and automation, and the judgment calls that come with owning access decisions for the whole company.

The role carries genuine technical breadth and will suit an engineer who treats recurring manual work as a defect to be resolved using AI-systems or repeatable automation rather than a task to be repeated.

What You’ll Do

• Identity lifecycle and onboarding/offboarding - own employee lifecycle end to end, from HRIS system through Okta to downstream applications
• Identity automation - build and maintain automation in Okta Workflows, driven by our HRIS as the source of truth
• Machine and AI agent identity - extend IAM practices to non-human identities: define how service accounts, bots, and AI agents are provisioned, scoped, reviewed, and deprovisioned, applying the same rigor to machine identity as you do to human access.
• Access governance - own the access request and approval process, keeping routine access efficient and sensitive access controlled and auditable
• Self-service access & IGA - continue to build self-service access and define/maintain per-role access policies refined each cycle
• Application access and provisioning - onboard new applications to SSO and automated provisioning, design role-based access for applications, including Okta group structure, application role mappings, SCIM provisioning, and push groups
• Security review and cross-functional partnership - review of new integrations and access requests, assessing permission scope and credential exposureAudit and compliance - provide identity evidence for PCI, SOC 2, and ISO 27001

What We’re Looking For:

• You’re an identity engineer with deep IdP expertise. Okta experience is strongly preferred, but other platforms (Entra ID/Ping) will be considered
• Five or more years in IAM, identity engineering, or a closely related security discipline, with demonstrable ownership of an identity platform rather than operational support.
• Proficiency in automation in Python, JavaScript, or similar, to support the automation of routine identity tasks and reduce manual work - for us manual repetitive work is a defect. Fluent with AI tooling and able to understand how to utilize and leverage AI to enhance IAMs capabilities and service delivery.
• Experience owning technical employee onboarding and offboarding end to end, including managing access requests and approvals, and automating fulfillment through Okta rather than provisioning manually.
• Hands-on cloud IAM experience with at least one major cloud provider. AWS, GCP, or Azure - including roles, policies, permission boundaries, and identity federation.
• Experience with Infrastructure as Code for identity resources, such as Terraform, so that access configuration is version-controlled and reviewable
• Comfort with ambiguity and a strong sense of ownership. Much of this work is undefined until someone defines it, and we are looking for the person who will write it down.

Nice to Have

• Deep, practical Okta expertise across Universal Directory, profile mappings and sourcing, group rules and Expression Language, application assignments, SSO, and lifecycle management.
• Demonstrated experience automating identity processes with Okta Workflows or an equivalent identity automation platform, driven by an HRIS as the source of truth.
• Broader security knowledge beyond identity - for example security operations, vulnerability management, cloud security posture, or incident response.
• Experience governing machine identities, including service accounts, API tokens, bot users, and credentials for automation platforms or AI agents
• Exposure to IGA products, GRC platforms, or access certification tooling

Global Benefits:

Our global benefits are designed to help you thrive and grow, personally and professionally:

• Participate in Aiven’s equity plan.
• Balance work and life with our hybrid work policy.
• Choose the equipment you need to set yourself up for success.
• Use your Professional Development Plan budget for learning opportunities.
• Receive holistic wellbeing support through our global Employee Assistance Program.
• Inquire about our Global Time Off Commitment (Parental and Sick Leave, as well as Personal Time)
• Enjoy country-specific benefits for our global cast.

Equal Opportunities:

Aiven provides equal employment opportunities to all qualified employees and applicants for employment without regard to age, gender identity, national or ethnic origin, religion, sexual orientation, physical and mental ability, marital and family status or without regard to any other similar personal attributes. Aiven complies with applicable local laws governing non-discrimination in employment in every location in which the company operates. This policy applies to all terms and conditions of employment, including recruiting, hiring, placement, promotion, termination, layoff, transfer, leaves of absence, compensation, training and any other terms and conditions related to employment.

At Aiven we are committed to providing reasonable accommodations for qualified individuals with disabilities or special needs in our working environment and job application procedures. We make all reasonable accommodations for persons with disabilities or who otherwise need support to thrive in the workplace. We are committed to continuously improving workplace accessibility. There is an option to request a discussion in the application process but if you have any questions before applying please write to us at [e-mail].