IAM Security Software Engineer - Self-Serve Access

Vercel Inc.; San Francisco (CA); Hybrid; USD 208,000 - 312,000; Full time

Benefits offered by this job

Equity

Inclusive Healthcare Package

Mentorship & events

Flexible Time Off

WFH budget

Job summary

Vercel is seeking a Security Software Engineer, IAM, to own end-to-end identity infrastructure. This hybrid role is based in San Francisco or New York City, with three days in the office weekly.

You will transform IAM by coding identity and access management, enabling self-serve, time-bound access and automated SOC 2 evidence generation. The role emphasizes Terraform-based migrations, cloud security, and collaboration with product teams to enforce least-privilege access across corporate and

Qualifications

• 7+ years building and owning identity, access management, or platform security systems.
• Experience across corporate (Okta or equivalent) and production (AWS or GCP) environments.
• Strong engineering background with Terraform, IaC, and CI workflows.

Responsibilities

• Migrate IAM configurations to Terraform and promote infrastructure as code.
• Build a self-serve access platform with just-in-time access and time-bound permissions.
• Own provisioning, deprovisioning, and access review workflows to generate SOC 2 audit evidence.
• Unify corporate and production IAM into a single identity plane with least-privilege access.
• Define and build agent access requests in collaboration with Accounts team.

Skills

IAM design

Security systems

TypeScript/Node.js

Go

Python

OAuth2/OIDC

SOC 2

Tools

Terraform

AWS

GCP

Okta

SAML

OIDC

REST APIs

Job description

Vercel is seeking a Security Software Engineer, IAM, to own end-to-end identity infrastructure. This hybrid role is based in San Francisco or New York City, with three days in the office weekly.

You will transform IAM by coding identity and access management, enabling self-serve, time-bound access and automated SOC 2 evidence generation. The role emphasizes Terraform-based migrations, cloud security, and collaboration with product teams to enforce least-privilege access across corporate and