IAM Security Engineer - Hybrid LA, SSO/MFA, Zero-Trust

Socket.dev; Los Angeles (CA); On-site; USD 120,000 - 190,000; Full time

Job summary

TalentSystems, LLC in Los Angeles is seeking a Security Engineer, IAM to design, implement, and manage identity and access management across our global technology stack. This role ensures the right people have the right access to the right resources while preventing unauthorized access, in collaboration with Engineering, Product, Security and HR.

You will work on IAM architecture including SSO, MFA, RBAC, and PAM across cloud and on-prem environments, build federation using SAML, OAuth2.0, and

Qualifications

• 4+ years of hands-on experience in IAM engineering, identity security, or a closely related field.
• Proficiency with IAM protocols: SAML, OAuth2.0, OpenID Connect, LDAP, SCIM.
• Experience administering an enterprise identity provider (e.g., Okta, AzureAD/EntraID, Google Workspace Identity, or equivalent).
• Solid understanding of RBAC, least-privilege, and zero-trust principles.
• Familiarity with compliance frameworks including SOC2 Type II, GDPR, and ISO27001.
• Excellent written and verbal communication skills; able to explain complex identity concepts to non-technical stakeholders.
• Preferred: Experience with Privileged Access Management (PAM) tools (e.g., CyberArk, BeyondTrust, HashiCorp Vault).
• Preferred: Demonstrated ability to script and automate IAM workflows using Python, PowerShell, Bash, or similar.
• Preferred: Hands-on experience with cloud IAM (AWS IAM, GCP IAM, or Azure RBAC).
• Preferred: Background in SaaS or multi-tenant platform environments with complex user hierarchy management.
• Preferred: Exposure to entertainment, media, or marketplace platform security.
• Preferred: Experience working in a globally distributed team across multiple time zones.

Responsibilities

• Design, deploy, and maintain IAM solutions including SSO, MFA, RBAC, and PAM across cloud and on-premise environments.
• Architect and manage identity federation using protocols such as SAML, OAuth2.0, and OpenID Connect.
• Build and maintain lifecycle management processes for user provisioning, de-provisioning, and access reviews.
• Integrate IAM systems with SaaS platforms (Google Workspace, Slack, GitHub, Zendesk, and others) and internal applications.
• Develop and maintain automation for access request workflows and entitlement management.
• Conduct periodic access reviews and certification campaigns to ensure least-privilege principles are enforced.
• Monitor IAM systems for anomalous activity, access violations, and policy drift; respond to and remediate incidents.
• Support audit and compliance activities related to SOC2, PCI-DSS, GDPR, and other applicable frameworks.
• Define and enforce IAM policies, standards, and procedures in alignment with industry best practices.
• Collaborate with the Information Security Office to evaluate and close identity-related vulnerabilities.
• Partner with Engineering and DevOps teams to embed IAM controls into CI/CD pipelines and cloud infrastructure.
• Work with IT Team to align identity processes with endpoint and network security policies.
• Support onboarding, offboarding, and role-change workflows in coordination with People Operations.
• Participate in cross-functional planning to surface IAM-related risks, roadmap items, and quarterly priorities.

Skills

IAM engineering

Identity security

RBAC

least-privilege

zero-trust

Communications

Tools

Okta

Azure AD/Entra ID

Google Workspace Identity

SAML

OAuth 2.0

OpenID Connect

LDAP

SCIM

Job description

TalentSystems, LLC in Los Angeles is seeking a Security Engineer, IAM to design, implement, and manage identity and access management across our global technology stack. This role ensures the right people have the right access to the right resources while preventing unauthorized access, in collaboration with Engineering, Product, Security and HR.

You will work on IAM architecture including SSO, MFA, RBAC, and PAM across cloud and on-prem environments, build federation using SAML, OAuth2.0, and