Senior Identity Engineer — Zero Trust Architect

Openkrill; United States; Hybrid; USD 180.000 - 260.000; Vollzeit

Zusammenfassung

Hard Rock Digital is building a high-trust identity program. We seek a Principal Identity Engineer to own the architecture, governance, and rollout of identity across a global workforce.

You will lead security controls for Entra ID, federation, and privileged access, while shaping zero-trust strategy with executive leadership. You will be the first dedicated identity hire, partnering with IT, GRC, and security operations to ensure auditable, scalable access controls across cloud and on-prem

Qualifikationen

• 10+ years in identity and access management, security engineering, or a closely related field — or equivalent practical experience.
• Deep, hands‑on expertise with a modern enterprise identity platform — Conditional Access, PIM/PAM, authentication methods, and identity governance (Microsoft Entra ID).
• Strong command of identity protocols and patterns: SAML, OIDC, OAuth 2.0, SCIM, and modern MFA.

Aufgaben

• Own the security architecture, standards, authentication methods, and roadmap for Microsoft Entra ID, our primary identity provider — partnering with IT on tenant operations
• Design and continuously refine Conditional Access policies that balance strong protection with a smooth experience for a globally distributed workforce
• Advance our rollout of phishing-resistant, passwordless authentication (passkeys, certificate-based, FIDO2)
• Own federation and single sign-on across our SaaS estate (SAML, OIDC, OAuth 2.0, SCIM provisioning)
• Own our privileged access model using Microsoft Entra PIM — separate admin identities, just-in-time elevation, and approval workflows
• Design and maintain break-glass procedures and safeguards for our most sensitive administrative paths
• Reduce standing privilege across the environment and make "least privilege, just in time" the default
• Automate the joiner-mover-leaver lifecycle so access is granted, changed, and revoked accurately and promptly
• Build and run access reviews and entitlement governance, partnering with our GRC team on audit evidence (ISO 27001, SOC 2, PCI DSS, GLI-19/GLI-33)
• Make access decisions auditable, explainable, and continuously right sized
• Govern service principles, managed identities, and workload/federated credentials across AWS, Azure, and GCP
• Partner on secrets governance across our secrets management platforms to shrink the number of long-lived, standing secrets
• Partner with our Principal Cloud & Network Security Engineer, who owns service-to-service authentication (mTLS, service mesh)
• Serve as the identity authority for our Zero Trust program, aligned to NIST SP 800-207 and the CISA Zero Trust Maturity Model (Identity pillar)
• Partner with our cloud and network security function on identity-aware access through Cloudflare Access
• Partner with Security Operations to make identity signals (risky sign-ins, privileged elevation, MFA anomalies) first-class inputs to detection and response
• Advise on customer identity (CIAM) and account-security architecture — partnering with our Principal Product Security Engineer, who owns the application security of player-facing account flows, and with product engineering
• This is a big charter by design — year one is about sequencing. You'll set the identity roadmap with the CISO, with leadership backing to execute against it.
• Our 24/7 Security Operations team owns monitoring; you'll be the escalation point for identity-related incidents.

Kenntnisse

Identity & access management

Microsoft Entra ID

Conditional Access

PIM/PAM

SAML

OIDC

OAuth 2.0

SCIM provisioning

Automation

PowerShell

Tools

Microsoft Graph API

Python

Jobbeschreibung

Hard Rock Digital is building a high-trust identity program. We seek a Principal Identity Engineer to own the architecture, governance, and rollout of identity across a global workforce.

You will lead security controls for Entra ID, federation, and privileged access, while shaping zero-trust strategy with executive leadership. You will be the first dedicated identity hire, partnering with IT, GRC, and security operations to ensure auditable, scalable access controls across cloud and on-prem