Senior Identity Governance Engineer

ServiceTitan; San Francisco (CA); On-site; USD 126,000 - 202,000; Full time

Benefits offered by this job

Flexible time off

Company-paid medical, dental, and >vis

Parental leave and fertility support

Job summary

ServiceTitan is seeking an experienced Identity Governance Engineer to design and implement governance for access across enterprise tools and data platforms. You will own the policies, automate reviews, and ensure least-privilege access for critical systems, including non-human identities and AI integrations.

The role partners with Corporate Security, Security Architecture, Product Security, and Security Operations to build scalable identity solutions and continuous governance, advancing the

Qualifications

• 5+ years in identity and access with depth in Identity Governance & Administration.
• Experience in identity engineering (SSO, provisioning, directory automation).
• Knowledge of RBAC/ABAC and entitlement modeling; least-privilege concepts.
• Automation scripting experience (Python or Go) and API integration.
• Experience with governance programs (SOX ITGC, PCI DSS, SOC 2) and audit-ready evidence.

Responsibilities

• Define and implement identity governance tooling and workflows across enterprise systems.
• Lead access review programs and onboarding/offboarding lifecycle automation.
• Design authentication and authorization standards (SSO, MFA, OIDC/SAML/SCIM).
• Develop entitlement models and role-based access controls for critical systems.
• Collaborate with Corporate Security, Product Security, and IT to ensure governance by design.

Skills

Identity governance

Identity engineering

RBAC/ABAC

Automation scripting

Security governance

Access reviews

Tools

Veza

Lumos

Okta

Snowflake

Salesforce

Job description

Ready to be a Titan? At ServiceTitan, we are building a next-generation identity fabric, and this role engineers the governance layer on top of it. Identity spans cloud environments, SaaS applications, data systems, machine identities, and now AI agents, which makes it one of the most sprawling attack surfaces in the enterprise. You will make sure every identity, whether a Titan, a third-party contractor, a service account, or an AI agent, has the right access, for the right reason, at the right time, and that we can prove it. Corporate Engineering (IT) administer our identity platforms, including Okta and Lumos, and run lifecycle operations. InfoSec defines identity governance requirements and validates that controls work. You sit in InfoSec and engineer the governance layer: authentication and authorization design standards, entitlement models, access review automation, and audit-ready evidence. You administer Veza with Corporate Security, Security Architecture, Product Security, and Security Operations, work with Corporate Engineering and System Owners to put governance requirements into practice, and you will be a key owner of our ISPM and IGA program.

What you'll do:

You engineer identity governance: the tooling, automation, and design standards that make access reviewable and provable. Corporate Engineering and IT administer the identity platforms, and InfoSec GRC owns the policies and the review program.

Access Request Governance:

Define governance requirements and design patterns for access request workflows across privileged systems (code repositories, databases, infrastructure), including role-based, time-bound, delegated, and just-in-time access, and measure adoption so access is not granted outside the governed workflow. Corporate Engineering and IT administer Lumos and implement the workflows; you specify the requirements, build the monitoring that detects bypass, and validate that they work.

Authentication & Authorization Design:

Partner with Security Architecture to define authentication and authorization design standards (SSO, MFA and phishing-resistant requirements, OIDC/SAML/SCIM patterns, least-privilege role models) for enterprise tools, and review integrations against them.

Authorization Governance & Entitlement Design:

Provide the technical design for authorization decisions on job functions and privileged data access, including critical systems such as ST Admin roles, Snowflake, Salesforce, and other high-risk entitlements. Build role models scoped to job function and normalize entitlement data across applications in Veza so access can be reviewed like for like.

Access Review & Lifecycle Automation:

Build and operate the tooling and automation behind the user access review program (SOX ITGC, PCI DSS, SOC 1/2, ISO 27001), which InfoSec GRC owns, and behind joiner/mover/leaver control assurance, including leaver access-reversion evidence, reconciliation against the authoritative HR source, and orphaned account detection.

Privileged Access Governance:

Build visibility into standing privileged access across core cloud infrastructure and the data platform and drive it down, moving toward time-bound elevation (PIM and JIT) with governed exceptions for the access that must remain.

Identity Fabric Architecture:

Define the target-state governance architecture across Okta, Veza, and Lumos and the risk-based identity lifecycle it supports. You administer Veza in combination with Corporate Security, Security Architecture, Product Security, and Security Operations, building its data source integrations, policies, and alerts. Corporate Engineering and IT administer Okta and Lumos, and you partner with them on lifecycle and workflow integration.

ISPM & Continuous Governance:

Add continuous monitoring to periodic certifications. Build identity analytics that detect over-privileged accounts, shadow identities, dormant access, and identity drift, and automate remediation workflows with named owners.

Non-Human Identity & AI Security:

Build the inventory and governance workflows for service accounts, API keys, personal access tokens, and AI agents, including ownership, rotation, and attestation requirements, and drive remediation with owning teams. Ensure AI integrations are covered by rigorous entitlement management, in partnership with our AI governance review process.

Cross-Functional Collaboration:

Work with Corporate Engineering, the administrative owner of identity platforms and lifecycle operations, alongside Security Architecture and System Owners to ensure every enterprise tool is integrated with identity by design, while InfoSec GRC defines identity governance requirements and validates control effectiveness.

Compliance as Code & Audit Support:

Provide the technical identity evidence for audit requests (SOX, PCI, ISO 27001, SOC 1/2), partnering with our SOX IT compliance team, who coordinate with auditors. Automate evidence collection so compliance is a byproduct of good engineering, not a manual chore.

Vendor Engagement:

Partner with Corporate Engineering to engage our strategic identity vendors (Veza, Okta, Lumos). Hold vendors accountable to their commitments and service levels, influence their product roadmaps, and secure the implementation and adoption support we need to maximize our return on investment.

What you'll bring:

We are looking for deep identity experience, whether in governance, administration, engineering, or a mix of these, paired with hands‑on technical skills. You build the tools that make governance work.

The Fundamentals:

• 5+ years in identity and access, with depth in Identity Governance & Administration.
• Broader experience in identity and access engineering (SSO, provisioning, directory or identity platform automation) is welcome alongside a governance background.
• You deeply understand lifecycle management (Joiner/Mover/Leaver), RBAC/ABAC and entitlement modeling, Separation of Duties, privileged access governance, and the Principle of Least Privilege, and you can design and automate access certification programs at enterprise scale.

The Modern Stack:

• Hands‑on experience with modern IGA and identity discovery tools (e.g., Veza for authorization graphs and entitlement visibility, Lumos for SaaS governance and access requests, Okta for lifecycle orchestration and identity governance workflows).
• Experience administering an authorization graph platform such as Veza is especially valuable, since you will own it in partnership with other security teams.

Authentication & Authorization Design:

• Working knowledge of authentication and authorization standards and patterns (SSO, OIDC, SAML, SCIM, MFA, RBAC/ABAC) and the ability to review enterprise integrations against them.

NHI Governance:

• Proven experience governing non-human identities (service accounts, API keys, workload identities) in cloud-native environments (AWS/GCP), including inventory, ownership assignment, rotation and expiry requirements, periodic attestation, and risk exception handling. You can read cloud IAM and secrets management configurations and partner with the engineering teams who operate those platforms.

Security Posture:

• Understanding of ISPM principles, including detecting identity drift, excessive entitlements, orphaned accounts, and misconfigurations before they are exploited, and turning those findings into governed remediation.

Compliance Fluency:

• Ability to translate regulatory and audit requirements (SOX ITGC, PCI DSS, SOC 2, ISO 27001) into identity controls, automated workflows, and audit-ready evidence. You are comfortable working directly with internal and external auditors.

Automation & Engineering Skills:

• Proficiency in a scripting language (e.g., Python or Go), plus API integration experience and familiarity with workflow or low-code tooling, to automate access reviews, evidence collection, and remediation tracking.

Who You Are

A Systems Thinker:

• You understand the balance between People, Process, and Technology. You don't just fix a ticket; you fix the process that created the ticket.

An Enabler of Innovation:

• You believe security should be a tailwind, not a headwind. You build identity governance that lets Titans move faster and collaborate safely.

Data-Driven:

• You use identity analytics to find high-risk areas and prioritize work based on actual risk data.

Why This Role Matters

As ServiceTitan scales and integrates AI across our platform, identity governance is what keeps access defensible. Your work protects customer data, supports the trust our customers place in us, and lets our teams move faster with confidence.

Be Human With Us

Being human isn’t about checking every box on a list. It’s about the experiences we have, people we meet, and the perspectives we share. So, if you have the skills but are hesitant to apply because of your background, apply anyway. We need amazing people like you to help us challenge the conventional and think differently about the problems that we’re solving. We’re in this together. Come be human, with us.

Use of AI Technology

We use technology, including automated and AI‑assisted tools, to support certain aspects of our recruitment process. These tools are designed to improve efficiency and enhance the candidate experience. AI tools are not used to make hiring decisions; all hiring decisions are made by our hiring teams.

What We Offer

When you join our team, you’re not just accepting a job. You’re making a career move. Here’s how we’ll support you in doing some of the most impactful work of your career:

Flextime, recognition, and support for autonomous work

• Flexible time off with ample learning and development opportunities to continue growing your career. We offer a comprehensive onboarding program, leadership training for Titans at all levels, and other programs and events. Great work is rewarded through Bonusly, peer-nominated awards, and more.

Holistic health and wellness benefits:

• Company-paid medical, dental, and vision (with 100% employer paid options and 90% coverage for dependents), FSA and HSA, 401k match, and telehealth options including memberships to One Medical.

Support for Titans at all stages of life:

• Parental leave and support, up to $20k in fertility services (i.e. IUI and IVF), surrogacy, and adoption reimbursement, on demand maternity support through Maven Maternity, free breast milk shipping through Maven Milk, pet insurance, legal advisory services, financial planning tools, and more.

At ServiceTitan, we celebrate individuality and uniqueness. We believe that the convergence of fresh perspectives and experiences from all walks of life is what makes our product and culture so great. We strongly encourage people from underrepresented groups to apply.

We do not discriminate against employees based on race, color, religion, sex, national origin, gender identity or expression, age, disability, pregnancy (including childbirth, breastfeeding, or related medical condition), genetic information, protected military or veteran status, sexual orientation, or any other characteristic protected by applicable federal, state or local laws.

ServiceTitan is committed to fair and equitable compensation for all of our employees. We thoughtfully consider a wide range of factors when determining individual compensation, which may change over time. We comply with all applicable minimum wage laws. For candidates in the United States, the good faith salary ranges estimate for this role is

Zone 1: $134,500 USD - $201,700 USD Applicable for: CA, CT, DC, MD, MA, NJ, NY, VA, and WA

Zone 2: $125,700 USD - $188,500 USD Applicable for: All other US locations.

International Compensation for candidates residing outside the United States will vary by location and will be discussed during the hiring process. Actual compensation within a range is determined by factors including relevant experience, skill set, qualifications, and performance. In addition to base salary, our total compensation package includes an annual bonus, equity, and a holistic suite of benefits.