IAM Engineer

Optomi; San Antonio (TX); Hybrid; USD 120,000 - 180,000; Full time

Job summary

Optomi, in partnership with an exciting Security end-client, seeks a hands-on security engineer to own application-layer IAM in a multi-tenant SaaS product. You will implement tenant isolation, role-based access, and ensure proper least privilege.

You will design AWS IAM policies, manage multi-account boundaries, and build insider-risk controls to prevent data export by any single person. This role is remote or hybrid in Austin or San Antonio, with a competitive contract-to-hire pay range.

Qualifications

• Experience with application-layer IAM in multi-tenant SaaS.
• Experience designing insider-risk / separation of duties controls.
• Experience with AWS IAM policy design and cross-account boundaries.
• Writes production code; this is not advisory or architecture-only.

Responsibilities

• Develop application-layer IAM for a multi-tenant product.
• Implement insider-risk controls with least privilege and separation of duties.
• Design AWS IAM policies and multi-account boundaries.
• Ensure access-layer audit logging for investigations.

Skills

IAM in SaaS

Insider-risk controls

Least privilege

Separation of duties

Production code

AWS IAM policy design

Tools

AWS

Multi-account boundaries

Job description

Optomi, in partnership with an exciting Security end-client, stores sensitive personal data for principals, including SSNs, and needs a strong access-control model at the application layer with insider risk treated as a primary threat, not an afterthought. This role will work closely with Data Protection & Encryption Engineers.

What You\'ll Own:

• Application-layer IAM in a multi-tenant product: roles, permissions, and tenant isolation
• Insider-risk controls — least privilege and separation of duties, specifically ensuring no single person can export the full dataset
• AWS security: IAM policy design, multi-account boundaries, and detection
• Access-layer audit logging sufficient to support an investigation

Required Experience:

• Application-layer IAM in a multi-tenant SaaS product, including tenant isolation
• AWS IAM policy design and multi-account security boundaries
• Designing insider-risk / separation-of-duties controls, beyond basic RBAC
• Writes production code — this is not an advisory or architecture-only role

This role will be remote/hybrid in Austin or San Antonio Texas with a competitive pay range on a contract to hire basis!