Principal Identity Architect

Epsilon; Westminster (CO); On-site; USD 128,000 - 238,000; Full time

Benefits offered by this job

Comprehensive health coverage

401(k)

Tuition assistance

Commuter benefits

Professional development

Job summary

Epsilon is seeking a Principal Identity Architect to lead identity modernization, moving from legacy SAML and long-lived credentials to an OAuth 2.1 / OIDC-first model across multi-cloud environments. You will design secure, scalable identity patterns and partner with Security, Cloud, Platform, and Engineering teams to replace API keys with ephemeral machine identities.

This hands-on leadership role requires mentoring engineers, driving strategy, and turning architecture into real-world

Qualifications

• 7+ years in IAM, security engineering, or platform roles.
• 3+ years hands-on with OAuth 2.0 / OIDC in production.
• Experience modernizing identity (SAML → OIDC or similar).
• Experience with AWS, Azure, or GCP identity services.
• Strong token flows, scopes, claims, and secure design patterns.
• Ability to lead initiatives and deliver at scale.

Responsibilities

• Lead adoption of OAuth 2.1 / OIDC; drive migration from SAML and legacy auth.
• Design secure token flows (Auth Code + PKCE, Client Credentials, delegated access).
• Define standards for token usage, scopes, claims, and lifecycle management.
• Reduce risk from token leakage, replay, and over-permissioning.
• Replace long-lived credentials with modern machine identity patterns.
• Design M2M authentication for APIs, data pipelines, and platform workloads.
• Partner with teams on service account migration and secrets reduction.
• Build reusable identity patterns across IdPs, API gateways, and cloud platforms.
• Enable secure, scalable access across AWS, Azure, and/or GCP.
• Troubleshoot complex auth issues in hybrid and multi-cloud environments.
• Apply Zero Trust principles (least privilege, scoped access).
• Improve identity logging, monitoring, and audit readiness.
• Establish governance for OAuth apps, scopes, and access policies.
• Drive identity modernization programs end-to-end.
• Mentor architects and engineers; set technical standards.
• Break down complex initiatives into actionable workstreams.
• Lead incident response and improve operational visibility.

Skills

OAuth 2.1 / OIDC

Token flows design

Machine identity

SAML → OIDC modernization

Cloud identity services (AWS/Azure/GCP

Leadership & mentoring

Security engineering

Education

Bachelor's or Master's in Computer Science or related field

Tools

Okta

Entra ID / Azure AD

Auth0

SPIFFE/SPIRE

OPA

Python scripting

Job description

Overview

As a Principal Identity Architect, you will lead Epsilon’s identity modernization—transitioning from legacy SAML and long-lived credentials to a modern, OAuth 2.1 / OpenID Connect (OIDC)-first model. You’ll design secure, scalable identity patterns across multi-cloud environments while enabling teams to build with speed and confidence.

You’ll partner closely with Security, Cloud, Platform, and Engineering teams to replace API keys and service accounts with scoped, ephemeral machine identities, establish enterprise standards, and deliver secure, developer-friendly integrations. This is a hands‑on leadership role for someone who can drive strategy, mentor engineers, and turn architecture into real-world implementations.

Responsibilities

Modern Identity Architecture

• Lead adoption of OAuth 2.1 / OIDC; drive migration from SAML and legacy auth
• Design secure token flows (Auth Code + PKCE, Client Credentials, delegated access)
• Define standards for token usage, scopes, claims, and lifecycle management
• Reduce risk from token leakage, replay, and over-permissioning

Machine & Non-Human Identity

• Replace long-lived credentials with modern machine identity patterns
• Design M2M authentication for APIs, data pipelines, and platform workloads
• Partner with teams on service account migration and secrets reduction

Platform & Integration Engineering

• Build reusable identity patterns across IdPs, API gateways, and cloud platforms
• Enable secure, scalable access across AWS, Azure, and/or GCP
• Troubleshoot complex auth issues in hybrid and multi-cloud environments

Security, Governance & Observability

• Apply Zero Trust principles (least privilege, scoped access)
• Improve identity logging, monitoring, and audit readiness
• Establish governance for OAuth apps, scopes, and access policies

Leadership & Delivery

• Drive identity modernization programs end-to-end
• Mentor architects and engineers; set technical standards
• Break down complex initiatives into actionable workstreams
• Lead incident response and improve operational visibility

Qualifications

• Bachelors or Masters in Computer Science or related field.
• 7+ years in IAM, security engineering, or platform roles
• 3+ years hands‑on with OAuth 2.0 / OIDC in production
• Strong expertise in token flows, scopes, claims, and secure design patterns
• Experience implementing machine identity (M2M, workload identity, etc.)
• Track record of modernizing identity (SAML → OIDC or similar)
• Experience with AWS, Azure, or GCP identity services
• Ability to lead initiatives, influence teams, and deliver at scale

How You’ll Stand Out From Other Talent

• Experience with API security, data platforms, or service-to-service auth at scale
• Familiarity with SPIFFE/SPIRE, OPA, or advanced authorization models
• Experience with Okta, Entra ID (Azure AD), Auth0, or Ping
• Exposure to AI/agent-based identity patterns
• Scripting or automation (Python, Bash)

Additional Information

When you join Epsilon, we’ll create something EPIC together. We’re a global leader in data and identity, with deep expertise in digital media, clean rooms, customer data platforms, loyalty and marketing services. Positioned at the center of Publicis Groupe, Epsilon helps brands deliver personalized experiences at scale and build lasting customer relationships by unlocking the full potential of data and identity. Epsilon operates in 30+ countries across EMEA, the Americas and APAC, with more than 8,000 employees.

Check out a few of these resources to learn more about what makes Epsilon so EPIC:

Our Culture: https://www.epsilon.com/us/about-us/our-culture-epsilon

Life at Epsilon: https://www.epsilon.com/us/about-us/epic-blog

Epsilon Has Five Values That Define Our Culture And Guide Us As We Create Value For Our Clients, Our People And Consumers. We Seek Candidates Who Align With Our Company Values, Demonstrate Them And Make Them Meaningful In Their Day-to-day Work

• Act with integrity. We are transparent and have the courage to do the right thing.
• Work together to win together. We believe collaboration is the catalyst that unlocks our full potential.
• Innovate with purpose. We shape the market with big ideas that drive big outcomes.
• Respect all voices. We embrace differences and foster a culture of connection and belonging.
• Empower with accountability. We trust each other to own and deliver on common goals.

Because You Matter

Epsilon is an Equal Opportunity Employer. Epsilon’s policy is not to discriminate against any applicant or employee based on actual or perceived race, age, sex or gender (including pregnancy), marital status, national origin, ancestry, citizenship status, mental or physical disability, religion, creed, color, sexual orientation, gender identity or expression (including transgender status), veteran status, genetic information or any other characteristic protected by applicable federal, state or local law. Epsilon also prohibits harassment of applicants and employees based on any of these protected categories. Epsilon will provide accommodations to applicants who need accommodations to complete the application process. Please reach out to [e-mail] to request an accommodation.

For San Francisco Bay and Los Angeles Areas

Epsilon will consider qualified applicants with criminal histories for employment in a manner consistent with the City of Los Angeles’ Fair Chance Initiative for Hiring Ordinance and San Francisco Police Code Sections 4901-4919, commonly referred to as the San Francisco Fair Chance Ordinance. Applicants with criminal histories are welcome to apply.

Benefits

• Time to recharge: Flexible time off (FTO), 14 paid holidays, paid sick time
• Family well-being: Parental/new child leave, childcare & elder care assistance, adoption assistance
• Extra perks: Comprehensive health coverage, 401(k), tuition assistance, commuter benefits, professional development, employee recognition, charitable donation matching, health coaching and counseling

Epsilon benefits are subject to eligibility requirements and other terms.

Compensation Range

Compensation Range: USD $127,900.00 - USD $237,500.00/Annually. This is the pay range the Company believes it will pay for this position at the time of this posting. Consistent with applicable law, compensation will be determined based on the skills, qualifications, and experience of the applicant along with the requirements of the position, and the Company reserves the right to modify this pay range at any time. Temporary roles may be eligible to participate in our freelancer/temporary employee medical plan through a third-party benefits administration system once certain criteria have been met. For regular roles, the Company will offer medical coverage, dental, vision, disability, 401k, and paid time off. The Company anticipates the application deadline for this job posting will be 10/12/2026.