Senior IAM Engineer: OAuth, MFA & CIAM Architect

Bestica Inc.; Wilmington (DE); On-site; USD 150,000 - 190,000; Full time

Job summary

Bestica Inc. is seeking a Senior IAM Engineer to design, build, and secure identity for employees and customers. You will own sign-in, access controls, and how applications and APIs trust each other.

This hands-on role dives into OAuth 2.0, OpenID Connect, MFA, and large-scale CIAM and workforce IAM design, collaborating with security, product, and compliance teams to drive identity architecture forward.

Qualifications

• 10+ years in identity and access management or security engineering with hands-on IAM.
• Deep, protocol-level understanding of OAuth 2.0 and OpenID Connect: grant types, token validation, and common mistakes.
• Hands-on experience deploying phishing-resistant authentication with FIDO2/WebAuthn, passkeys or hardware keys.

Responsibilities

• Design and implement OAuth 2.0 and OpenID Connect flows for web, mobile, SPAs, and service-to-service apps.
• Define token usage, scopes, claims, audiences, lifetimes and revocation for apps and APIs.
• Review identity integrations and fix insecure token handling patterns before release.
• Lead rollout of phishing-resistant MFA using FIDO2/WebAuthn and hardware keys.
• Plan migration away from weaker factors for privileged users first.
• Own employee and contractor identity across joiner/mover/leaver processes.
• Implement SSO, conditional access, RBAC and privileged access controls.
• Support access reviews and audit evidence for SOC 2 and ISO 27001.

Skills

OAuth 2.0

OpenID Connect

FIDO2/WebAuthn

SSO

RBAC

MFA

SOC 2

Tools

Microsoft Entra ID

Okta

Ping Identity

Auth0

Job description

Bestica Inc. is seeking a Senior IAM Engineer to design, build, and secure identity for employees and customers. You will own sign-in, access controls, and how applications and APIs trust each other.

This hands-on role dives into OAuth 2.0, OpenID Connect, MFA, and large-scale CIAM and workforce IAM design, collaborating with security, product, and compliance teams to drive identity architecture forward.