Senior IAM Engineer - Secure Identity & Access

Brex; San Francisco (CA); Hybrid; USD 240,000 - 300,000; Full time

Job summary

Brex is seeking an Identity and Access Management engineer based in San Francisco. The role sits in a hybrid office setup with in-office days Mon, Wed, Thu and occasional remote flexibility.

You will design and operate backend IAM systems, own security-critical auth workflows, and mentor engineers while collaborating across teams to improve login, SSO, MFA, OAuth and RBAC implementations.

Qualifications

• Strong backend engineering foundations.
• Experience leading complex projects and mentoring engineers.
• Solid API design, testing rigor, code quality, and documentation.
• Understanding of authentication, authorization, sessions, tokens, MFA, SSO, OAuth, SAML, OIDC, or RBAC.
• Clear communication and collaboration across teams.
• Focus on operational excellence and reliability.
• Ability to balance security, usability, and developer experience.

Responsibilities

• Design, build, and operate backend IAM systems and APIs.
• Lead engineers on initiatives end to end, from design to rollout and support.
• Improve login and access experiences for SSO, MFA, delegated access, and enterprise flows.
• Build authorization systems with role-based access control and secure defaults.
• Create durable, identity-aware audit trails and attribution for actions.
• Collaborate with Brex engineers to secure IAM integrations by default.
• Mentor engineers to improve code quality and reliability.

Skills

Software engineering

Project leadership

API design

IAM concepts

Clear communication

Operational excellence

Security vs usability

Job description

Brex is seeking an Identity and Access Management engineer based in San Francisco. The role sits in a hybrid office setup with in-office days Mon, Wed, Thu and occasional remote flexibility.

You will design and operate backend IAM systems, own security-critical auth workflows, and mentor engineers while collaborating across teams to improve login, SSO, MFA, OAuth and RBAC implementations.