Lead Identity & Access Management Engineer

Koch; Región Centro; Presencial; MXN 900.000 - 1.300.000; Jornada completa

Descripción de la vacante

Koch is seeking a Lead IAM Engineer to define and evolve its global identity strategy, architecture, and platforms. This role leads authentication, federation, authorization, identity governance, and lifecycle automation across the enterprise, enabling secure access for users, applications, and services worldwide.

You will partner with global architects, engineers, security teams, and business partners, shaping the future of Identity at Koch through modern authentication technologies, Zero Trust

Formación

• Extensive experience owning identity platforms at scale and across SAML, OAuth2/OIDC, SCIM, and FIDO2.
• Hands-on architecture across Azure Entra ID, AWS IAM, or Google Cloud Identity.
• Strong coding skills in Python and/or TypeScript with Terraform or similar.

Responsabilidades

• Set IAM architecture and standards for SSO, federation, and privileged access.
• Lead design governance and reviews for new apps and platform changes.
• Build authentication and federation with SAML2, OAuth2/OIDC, WS-Fed, and FIDO2.
• Operate and enhance PingOne DaVinci or equivalent orchestration platforms.
• Design RBAC/ABAC/PBAC models and access workflows (IGA).
• Lead end-to-end JML automation integrating HRIS, ITSM, and directories via SCIM.
• Manage identity configuration as code using Terraform and CI/CD.
• Lead incident response for auth outages and credential compromise; drive RCA.

Conocimientos

IAM architecture

SAML/OIDC

OAuth 2.0

Terraform

Python/TypeScript

CI/CD

Herramientas

PingOne

PingOne DaVinci

Azure Entra ID

Descripción del empleo

We are looking for a Lead IAM Engineer to define and evolve Koch’s global identity strategy, architecture, and platforms. This role will serve as a technical leader for authentication, federation, authorization, identity governance, and lifecycle automation across the enterprise, enabling secure access experiences for users, applications, and services worldwide. Working closely with global architects, engineers, security teams, business partners, and customers, this individual will help shape the future of Identity at Koch through modern authentication technologies, Zero Trust principles, and scalable automation.

We are looking for a Lead IAM Engineer to define and evolve Koch’s global identity strategy, architecture, and platforms. This role will serve as a technical leader for authentication, federation, authorization, identity governance, and lifecycle automation across the enterprise, enabling secure access experiences for users, applications, and services worldwide. Working closely with global architects, engineers, security teams, business partners, and customers, this individual will help shape the future of Identity at Koch through modern authentication technologies, Zero Trust principles, and scalable automation.

The Koch Technology Identity team provides modern Identity solutions and services for all Koch businesses. We are responsible for the entire enterprise in designing innovative services, creating, and sharing best practices, and providing support for our services.

This role requires an in-office presence in our Zapopan office

What You Will Do

• Set IAM architecture & standards: Define reusable patterns for SSO/federation, authorization models, privileged access, and workload/machine identity.
• Lead design governance: Run identity design reviews for new applications and major platform changes; approve patterns, manage exceptions, and drive adoption.
• Build authentication & federation: Design and implement SAML2, OAuth2/OIDC, WS-Fed, and FIDO2/passkeys, including adaptive/risk-based auth, conditional access, and MFA.
• Engineer IAM platforms: Operate and enhance enterprise identity services (PingOne / PingOne DaVinci or equivalent orchestration platforms).
• Lead developer for IAM platforms: Serve as lead developer driving hands-on code development to build, extend, and maintain new and existing identity platforms, including custom connectors, APIs, and orchestration flows.
• Design authorization & governance: Build scalable RBAC/ABAC/PBAC models, entitlement catalogs, role engineering, and access request workflows (IGA).
• Automate identity lifecycle: Lead and design end-to-end JML automation integrating HRIS, ITSM, directories, and apps via SCIM and event-driven pipelines.
• Identity as Code: Manage identity configuration/policy using Terraform and CI/CD with testing, version control, and deployment discipline.
• Zero Trust & Detection: Implement least privilege and continuous verification; integrate ITDR-style monitoring, logging, alerting, SLOs, and rapid revocation.
• Incident leadership: Act as escalation for auth outages, federation issues, and credential compromise; lead RCA and post-incident hardening.
• Influence & mentoring: Partner globally with architects, developers, and security; coach engineers through reviews, playbooks, and training.

Who You Are (Basic Qualifications)

• Extensive experience owning identity platforms at scale, with deep protocol-level expertise across SAML, OAuth2/OIDC, SCIM, FIDO2/passkeys, LDAP, and Kerberos.
• Hands-on architecture across Azure Entra ID, AWS IAM, or Google Cloud Identity, including cross-cloud federation and hybrid identity patterns.
• Practical experience designing and building infrastructure across Azure, AWS, or GCP.
• Strong coding skills in Python and/or TypeScript, with API integrations, Git, CI/CD, and automated testing. Delivery of identity configuration as versioned, testable code using Terraform or similar technologies.
• Hands-on experience integrating diverse applications with enterprise governance platforms; design and delivery of JML automation, RBAC/ABAC/PBAC models and access workflows integrating HRIS, IAM, downstream apps via SCIM and event-driven pipelines.

What Will Put You Ahead

• Experience building multi-step user journeys for Workforce, CIAM, and partner ecosystems using platforms such as PingOne DaVinci or Okta Workflows.
• Hands-on development and design experience with SailPoint IdentityNow/IdentityIQ (or equivalent).
• Real-time detection and response to identity-based threats, integrating signals from IdPs, directories, and SIEM/SOAR platforms.

At Koch companies, we are entrepreneurs. This means we openly challenge the status quo, find new ways to create value and get rewarded for our individual contributions. Any compensation range provided for a role is an estimate determined by available market data. The actual amount may be higher or lower than the range provided considering each candidate's knowledge, skills, abilities, and geographic location. If you have questions, please speak to your recruiter about the flexibility and detail of our compensation philosophy.

Koch creates and innovates a wide spectrum of products and services that make life better. Our work spans a vast number of industries across the world, including engineered technology, refining, chemicals and polymers, pulp and paper, glass, electronics and many more. Headquartered in Wichita, Kansas, Koch employs about 120,000 employees across the globe. At Koch, employees are empowered to do what they do best to make life better. Learn how our business philosophy helps employees unleash their potential while creating value for themselves and the company. Additionally, everyone has individual work and personal needs. We seek to enable the best work environment that helps you and the business work together to produce superior results.