IAM Engineer

Bestica Inc.; Wilmington (DE); On-site; USD 150,000 - 190,000; Full time

Job summary

Bestica Inc. is seeking a Senior IAM Engineer to design, build, and secure identity for employees and customers. You will own sign-in, access controls, and how applications and APIs trust each other.

This hands-on role dives into OAuth 2.0, OpenID Connect, MFA, and large-scale CIAM and workforce IAM design, collaborating with security, product, and compliance teams to drive identity architecture forward.

Qualifications

• 10+ years in identity and access management or security engineering with hands-on IAM.
• Deep, protocol-level understanding of OAuth 2.0 and OpenID Connect: grant types, token validation, and common mistakes.
• Hands-on experience deploying phishing-resistant authentication with FIDO2/WebAuthn, passkeys or hardware keys.

Responsibilities

• Design and implement OAuth 2.0 and OpenID Connect flows for web, mobile, SPAs, and service-to-service apps.
• Define token usage, scopes, claims, audiences, lifetimes and revocation for apps and APIs.
• Review identity integrations and fix insecure token handling patterns before release.
• Lead rollout of phishing-resistant MFA using FIDO2/WebAuthn and hardware keys.
• Plan migration away from weaker factors for privileged users first.
• Own employee and contractor identity across joiner/mover/leaver processes.
• Implement SSO, conditional access, RBAC and privileged access controls.
• Support access reviews and audit evidence for SOC 2 and ISO 27001.

Skills

OAuth 2.0

OpenID Connect

FIDO2/WebAuthn

SSO

RBAC

MFA

SOC 2

Tools

Microsoft Entra ID

Okta

Ping Identity

Auth0

Job description

We are hiring a Senior IAM Engineer to design, build and secure identity for both our employees and our customers. You will own how people sign in, what they can access, and how our applications and APIs trust each other.

This is a hands‑on engineering role, not an SSO configuration role. You will work at the protocol level with OAuth 2.0 and OpenID Connect, lead our move to phishing‑resistant MFA, and shape identity architecture across workforce IAM and customer identity (CIAM).

Key responsibilities

Application and API identity

• Design and implement OAuth 2.0 and OpenID Connect flows for web, mobile, single‑page and service‑to‑service applications.
• Define how applications and APIs request, validate and use tokens, including scopes, claims, audiences, lifetimes and revocation.
• Review application teams' identity integrations and correct insecure token handling patterns before release.

Authentication and MFA

• Lead the rollout of phishing‑resistant MFA, including FIDO2/WebAuthn passkeys and hardware security keys such as YubiKeys.
• Plan the migration away from weaker factors (SMS, email codes, push approval) for privileged and high‑risk users first.
• Design enrollment, recovery and lost‑device processes that stay secure without overwhelming the help desk.

Workforce identity

• Own employee and contractor identity across joiner, mover and leaver processes.
• Implement SSO, conditional access, role‑based access and privileged access controls.
• Support access reviews and audit evidence for SOC 2, ISO 27001 or similar frameworks.

Customer identity (CIAM)

• Design customer sign‑up, sign‑in, social login and passwordless experiences that scale to large user populations.
• Balance account security (account takeover protection, bot defense, step‑up authentication) with conversion and user experience.
• Support privacy and consent requirements such as GDPR and CCPA in customer identity flows.

Architecture and collaboration

• Set identity standards and reference patterns that engineering teams can adopt.
• Partner with security, application, product and compliance teams, and explain identity trade‑offs to non‑specialists.
• Investigate and help respond to identity‑related incidents.

Required qualifications

• 10+ years in identity and access management, security engineering or a closely related role, with at least 3 years hands‑on in IAM.
• Deep, protocol‑level understanding of OAuth 2.0 and OpenID Connect: grant types, token types and their intended uses, token validation, and common implementation mistakes.
• Hands‑on experience deploying or engineering phishing‑resistant authentication with FIDO2/WebAuthn, passkeys or hardware security keys, and the ability to explain why these methods resist phishing.
• Experience with both workforce IAM and customer‑facing identity, and a clear view of how their goals, risks and design priorities differ.
• Working knowledge of SAML 2.0 and federation.
• Hands‑on experience with at least one major identity platform, such as Microsoft Entra ID, Okta, Ping Identity or Auth0.
• Ability to explain technical identity concepts clearly to engineers, auditors and business stakeholders.

Preferred qualifications

• Experience with dedicated CIAM platforms, such as Auth0, Okta Customer Identity, Microsoft Entra External ID, Ping or ForgeRock.
• Familiarity with newer OAuth security practices, such as PKCE, token binding approaches (DPoP or mTLS), and the OAuth 2.0 Security Best Current Practice.
• Experience with identity governance and administration (IGA) and privileged access management (PAM) tools, such as SailPoint, Saviynt or CyberArk.
• Experience with SCIM provisioning and API gateway authorization.
• Experience in a regulated industry, such as financial services, healthcare or legal.
• Relevant certifications, such as CISSP, Microsoft SC-300, Okta Certified Professional or Consultant, or a CIAM vendor certification.