Lead Cloud Identity Engineer

Koch Business Solutions, LP; Plano (TX); Hybrid; USD 110,000 - 150,000; Full time

Benefits offered by this job

Medical, dental, vision insurance

Flexible spending and health savings accounts

Paid vacation/time off

Educational assistance

Job summary

Koch Business Solutions, LP is seeking a Lead Cloud Identity Engineer in Plano, TX. This role offers an exciting chance to work within a global team managing authentication and identity tools for Koch Industries.

The ideal candidate will have extensive experience with various identity platforms, strong coding skills in Python/TypeScript, and a proven track record in designing and implementing secure identity solutions. The position requires in-office presence with flexibility across locations.

Qualifications

• Extensive experience owning identity platforms at scale.
• Deep protocol-level expertise across SAML, OAuth2/OIDC, SCIM.
• Strong coding skills in Python and/or TypeScript.
• Experience integrating diverse applications with enterprise governance.

Responsibilities

• Define reusable patterns for SSO/federation and authorization models.
• Lead identity design reviews; drive adoption of patterns.
• Design and implement SAML2, WS-Fed, and adaptive/risk-based auth.
• Build and enhance enterprise identity services.
• Serve as lead developer for identity platforms.

Skills

SAML

OAuth2/OIDC

Azure Entra ID

AWS IAM

Python

TypeScript

Terraform

RBAC

FIDO2

SCIM

Tools

PingOne

Okta Workflows

SailPoint IdentityNow

Job description

Your Job

We have an exciting opportunity to hire a Lead Cloud Identity Engineer to join our already skilled engineering team. This individual will be a part of a global team that manages authentication and identity tools and procedures for Koch Industries. Working closely with global colleagues, as well as customers, will provide significant global exposure.

Our Team

The Koch Technology Identity team provides modern Identity solutions and services for all Koch businesses. We are responsible for the entire enterprise in designing innovative services, creating, and sharing best practices, and providing support for our services.

Location

This role requires an in office presence with flexibility in Wichita, KS / Atlanta, GA / or Plano, TX

Visa Sponsorship

This role is not eligible for VISA sponsorship

What You Will Do

• Set IAM architecture & standards: Define reusable patterns for SSO/federation, authorization models, privileged access, and workload/machine identity.
• Lead design governance: Run identity design reviews for new applications and major platform changes; approve patterns, manage exceptions, and drive adoption.
• Build authentication & federation: Design and implement SAML2, OAuth2/OIDC, WS-Fed, and FIDO2/passkeys, including adaptive/risk-based auth, conditional access, and MFA.
• Engineer IAM platforms: Operate and enhance enterprise identity services (PingOne / PingOne DaVinci or equivalent orchestration platforms).
• Lead developer for IAM platforms: Serve as lead developer driving hands‑on code development to build, extend, and maintain new and existing identity platforms, including custom connectors, APIs, and orchestration flows.
• Design authorization & governance: Build scalable RBAC/ABAC/PBAC models, entitlement catalogs, role engineering, and access request workflows (IGA).
• Automate identity lifecycle: Lead and design end‑to‑end JML automation integrating HRIS, ITSM, directories, and apps via SCIM and event‑driven pipelines.
• Identity as Code: Manage identity configuration/policy using Terraform and CI/CD with testing, version control, and deployment discipline.
• Zero Trust & Detection: Implement least privilege and continuous verification; integrate ITDR‑style monitoring, logging, alerting, SLOs, and rapid revocation.
• Incident leadership: Act as escalation for auth outages, federation issues, and credential compromise; lead RCA and post‑incident hardening.
• Influence & mentoring: Partner globally with architects, developers, and security; coach engineers through reviews, playbooks, and training.

Who You Are (Basic Qualifications)

• Extensive experience owning identity platforms at scale, with deep protocol‑level expertise across SAML, OAuth2/OIDC, SCIM, FIDO2/passkeys, LDAP, and Kerberos.
• Hands‑on architecture across Azure Entra ID, AWS IAM, or Google Cloud Identity, including cross‑cloud federation and hybrid identity patterns.
• Practical experience designing and building infrastructure across Azure, AWS, or GCP.
• Strong coding skills in Python and/or TypeScript, with API integrations, Git, CI/CD, and automated testing. Delivery of identity configuration as versioned, testable code using Terraform or similar technologies.
• Hands‑on experience integrating diverse applications with enterprise governance platforms; design and delivery of JML automation, RBAC/ABAC/PBAC models and access workflows integrating HRIS IAM downstream apps via SCIM and event‑driven pipelines.

What Will Put You Ahead

• Experience building multi‑step user journeys for Workforce, CIAM, and partner ecosystems using platforms such as PingOne DaVinci or Okta Workflows.
• Hands‑on development and design experience with SailPoint IdentityNow/IdentityIQ (or equivalent).
• Real‑time detection and response to identity‑based threats, integrating signals from IdPs, directories, and SIEM/SOAR platforms.

Compensation

At Koch companies, we are entrepreneurs. This means we openly challenge the status quo, find new ways to create value and get rewarded for our individual contributions. Any compensation range provided for a role is an estimate determined by available market data. The actual amount may be higher or lower than the range provided considering each candidate's knowledge, skills, abilities, and geographic location. If you have questions, please speak to your recruiter about the flexibility and detail of our compensation philosophy.

Our Benefits

Our goal is for each employee, and their families, to live fulfilling and healthy lives. We provide essential resources and support to build and maintain physical, financial, and emotional strength - focusing on overall wellbeing so you can focus on what matters most. Our benefits plan includes medical, dental, vision, flexible spending and health savings accounts, life insurance, ADD, disability, retirement, paid vacation/time off, educational assistance, and may also include infertility assistance, paid parental leave and adoption assistance. Specific eligibility criteria is set by the applicable Summary Plan Description, policy or guideline and benefits may vary by geographic region. If you have questions on what benefits apply to you, please speak to your recruiter.

Equal Opportunities

Equal Opportunity Employer, including disability and protected veteran status. Except where prohibited by state law, some offers of employment are conditioned upon successfully passing a drug test. This employer uses E‑Verify. Additional information regarding E‑Verify is available. (For Illinois E‑Verify information additional details are available.)