AVP, IAM AI Engineer

LPL Financial; New York (NY); On-site; USD 123,000 - 204,000; Full time

Job summary

LPL Financial is seeking an AVP IAM AI Engineer to design, operate, and automate identity controls for both human and non-human actors. You will build runtime controls, secrets workflows, and governance guardrails to enable safe AI adoption and scale the team, embedding identity and AuthN/AuthZ in AI development from the start.

The role requires strong hands-on engineering, leadership experience, and collaboration with security and data science teams to deliver secure identity solutions across

Qualifications

• 5+ years in identity & access management or information security.
• Experience leading technical teams.
• 5+ years with Ping Identity (PingFederate/PingOne/PingAccess) or equivalent.
• 5+ years with SailPoint (IdentityIQ/Identity Security Cloud) or equivalent.
• 3+ years with Idira/CyberArk or HashiCorp Vault or equivalent.

Responsibilities

• Operationalize identity runtime controls across human and non-human identities.
• Governance for AI agents and non-human identities, including provisioning and deprovisioning.
• Develop and automate secrets-manager workflows for AI systems and agents.
• Define and enforce least-privilege authorization models as code.
• Establish reference patterns for identity flows in agentic systems.
• Partner with AI development teams on identity, AuthN/AuthZ and secrets handling.
• Support end-user IAM deployment where required.
• Integrate identity telemetry with SIEM/SOC and respond to incidents.
• Collaborate on governance, risk & compliance and audits.
• Recruit, mentor, and lead a team for IAM workstreams.

Skills

Python

Terraform

CI/CD

REST API

IAM

OIDC

OAuth 2.0

Kubernetes

Education

BS in CS/InfoSec

Tools

Ping Identity

SailPoint

CyberArk

HashiCorp Vault

AWS

Azure

GCP

Job description

Where Ambition Meets Innovation

Build a career that matches all your initiative with an impressive dose of innovation. From cutting-edge resources and a collaborative environment to the freedom to make an impact and more, you’ll find the ingredients you need at LPL Financial to shape your success while helping clients pursue their financial goals.

Job Overview

We are looking for an AVP, IAM AI Engineer to design, operationalize, and automate the identity controls that govern both human and non-human actors across our environment - with a specific focus on AI agents and the emerging class of agentic and non-human identities (NHI). This is a hands-on engineering and technical leadership role: you will build the runtime controls, secrets workflows, and governance guardrails that let the organization adopt AI safely, while standing up and growing a team to sustain and scale that work. You will be embedded in new AI application development from the earliest design stages, ensuring identity, authentication, and authorization are built in rather than bolted on.

Responsibilities

• Identity runtime controls. Operationalize and automate identity runtime controls across human and non-human identities, including real-time authentication, authorization, and policy enforcement.
• NHI & agentic governance. Design, build, and automate governance controls for AI agents and non-human identities - covering the full lifecycle: provisioning, entitlement, rotation, certification/attestation, and deprovisioning.
• Secrets management for AI. Develop and automate secrets-manager workflows for AI systems and agents, including secret rotation, just-in-time and episodic credentials, and secure secret delivery to workloads.
• Least privilege & policy-as-code. Define and enforce fine-grained, least-privilege authorization models for agents and workloads, expressed as policy-as-code wherever possible.
• Reference architecture & standards. Establish standards and reference patterns for how identity flows through agentic systems - user-to-agent, agent-to-agent (A2A), and workload-to-service authentication and authorization.
• Embedded in AI development. Partner with engineering and data science teams on all new AI application development, ensuring identity, AuthN/AuthZ, and secrets handling are designed in from the start.
• End-user IAM deployment. Support the deployment and adoption of IAM controls for end users where required.
• Monitoring & response. Integrate identity telemetry with SIEM/SOC tooling; build monitoring and anomaly detection for NHI/agent behavior; support incident response for compromised or misused credentials.
• Governance, risk & compliance. Partner with GRC, risk, and audit stakeholders to ensure controls satisfy regulatory and internal requirements, and to produce audit evidence.
• Team building & leadership. Recruit, build, mentor, and lead a team to support these workstreams; set technical direction and roadmap for NHI and agentic IAM.

What are we looking for?

We’re looking for strong collaborators who deliver exceptional client experiences and thrive in fast-paced, team-oriented environments. Our ideal candidates pursue greatness, act with integrity, and are driven to help our clients succeed. We value those who embrace creativity, continuous improvement, and contribute to a culture where we win together and create and share joy in our work.

Requirements

• 5+ years in identity & access management or information security, including hands-on engineering.
• Demonstrated experience building and/or leading technical teams.
• 5+ years with Ping Identity (PingFederate / PingOne / PingAccess) or a comparable access-management / federation platform.
• 5+ years with SailPoint (IdentityIQ / Identity Security Cloud) or a comparable identity governance & administration (IGA) platform.
• 3+ years with Idira (CyberArk, formerly Conjur) / HashiCorp Vault or a comparable secrets-management platform.

Core Competencies

• Working knowledge of identity and authorization for both users and agents: user-to-agent and agent-to-agent (A2A) patterns, OIDC and OAuth 2.0/2.1 tokens, and API keys, across both authentication (AuthN) and authorization (AuthZ).
• Strong automation and engineering skills: proficiency in a scripting/programming language (e.g., Python), infrastructure-as-code (e.g., Terraform), CI/CD pipelines, and REST API integration.
• Experience applying IAM in cloud environments (AWS, Azure, and/or GCP) and in containerized / Kubernetes workloads.

Preferences

• Familiarity with workload-identity and machine-identity standards: SPIFFE/SPIRE, OAuth token exchange (RFC 8693), mTLS, and cloud workload-identity federation.
• Working understanding of AI/agentic systems: LLMs, agent frameworks, tool-calling, and emerging authentication patterns such as the Model Context Protocol (MCP).
• Experience in a regulated industry (financial services, healthcare, etc.) and with associated compliance regimes.
• Relevant certifications, e.g., CISSP, CyberArk (Defender/Sentry), SailPoint, Ping, or a major cloud security certification.
• Bachelor's degree in Computer Science, Information Security, or a related field, or equivalent practical experience.

Pay Range

$122,570.00 - $204,249.00

Actual base salary varies based on factors, including but not limited to, relevant skill, prior experience, education, base salary of internal peers, demonstrated performance, and geographic location. Additionally, LPL Total Rewards package is highly competitive, designed to support your success at work, at home, and at play - such as 401K matching, health benefits, employee stock options, paid time off, volunteer time off, and more.

Company Overview

LPL Financial Holdings Inc. (Nasdaq: LPLA) is among the fastest growing wealth management firms in the U.S. As a leader in the financial advisor-mediated marketplace(6) , LPL supports over 32,000 financial advisors and the wealth management practices of approximately 1,100 financial institutions, servicing and custodying approximately $2.3 trillion in brokerage and advisory assets on behalf of approximately 8 million Americans. The firm provides a wide range of advisor affiliation models, investment solutions, fintech tools and practice management services, ensuring that advisors and institutions have the flexibility to choose the business model, services, and technology resources they need to run thriving businesses. For further information about LPL, please visit www.lpl.com.

At LPL, independence means that advisors and institution leaders have the freedom they deserve to choose the business model, services, and technology resources that allow them to run a thriving business. They have the flexibility to do business their way. And they have the freedom to manage their client relationships, because they know their clients best. Simply put, we take care of our advisors and institutions, so they can take care of their clients.

For further information about LPL, please visit www.lpl.com.

Join the LPL team and help us make a difference by turning life’s aspirations into financial realities.

Principals only. EOE.

Information on Interviews

LPL will only communicate with a job applicant directly from an @lplfinancial.com email address and will never conduct an interview online or in a chatroom forum. During an interview, LPL will not request any form of payment from the applicant, or information regarding an applicant’s bank or credit card. Should you have any questions regarding the application process, please contact LPL’s Human Resources Solutions Center at [phone].

EAC 5.19.26