Senior IT Security Engineer

Alloy; New York (NY); Hybrid; USD 162,000 - 190,000; Full time

Benefits offered by this job

Unlimited PTO

Employee stock options

Health/dental/vision plans

401k match

Parental leave

Home office stipend

Learning stipend

Well-being benefits

Hybrid work in NYC

Job summary

Alloy is seeking an IT/Security Engineer focused on workforce identity to own Okta and related IAM workflows. You’ll manage SSO integrations, lifecycle automation, and access governance in a hybrid NYC-area environment.

The role requires strong collaboration, troubleshooting, and an ability to evolve RBAC/ABAC across multiple SaaS platforms. Base salary ranges from $162,000 to $190,000 with equity options and a broad benefits package.

Qualifications

• Hands-on IT or security engineering with lead responsibility for Okta or a similar workforce identity provider.
• Experience administering IdP groups, access and authentication policies, SaaS app assignments, MFA, and admin roles.
• Experience implementing and troubleshooting SAML/OIDC SSO, SCIM provisioning, and OAuth-based integrations.
• Experience managing identity lifecycles across HR systems, an IdP, Google Workspace, and downstream SaaS apps.
• Ability to automate access workflows using Okta Workflows, APIs, scripts, or similar tools.
• Understanding of least privilege, RBAC/ABAC, access reviews, and account lifecycle controls.
• Familiarity with endpoint security, EDR, DLP, email security, and SaaS security tooling; able to work beyond IAM.
• Strong troubleshooting, documentation, and communication in a shared IT/Security team.

Responsibilities

• IAM and Okta Administration: serve as the SME for workforce identity, MFA, groups, policies, and admin roles.
• SaaS Access & Integrations: manage SaaS access, onboarding, and SSO integrations (SAML/OIDC); SCIM provisioning/deprovisioning.
• Identity Lifecycle & Automation: optimize joiner/mover/leaver workflows from HRIS through IdP to downstream SaaS.
• Access Operations: troubleshoot authentication/provisioning issues and streamline access requests.
• RBAC Management: evolve Alloy’s RBAC/ABAC model and access control strategy.
• Privileged Access Management: mature PAM/TPAM including just-in-time and break-glass procedures.
• Non-Human Identity Management: govern service accounts, API credentials, OAuth apps, tokens, bots.
• AI Identity & Access: shape delegated access for AI tools and MCP integrations.
• Access Governance & Compliance: run access reviews, enforce contractor expirations, provide IAM evidence for ISO/SOC2.
• Shared IT/Security Engineering: collaborate on endpoint security, EDR, DLP, email security, and SaaS tools.
• Incident Response & Collaboration: investigate identity-related incidents and maintain clear documentation.
• On-call Rotation: participate in IT/Security on-call for critical alerts.

Skills

Okta administration

SSO SAML/OIDC

SCIM provisioning

Identity lifecycle automation

RBAC/ABAC

Troubleshooting & documentation

Communication in IT/Security

Tools

Google Workspace

Job description

Alloy is where you belong!

Alloy is the AI-powered identity and fraud prevention platform that accelerates onboarding, stops fraud, and scales compliance across the customer lifecycle so financial organizations can grow without limits. More than 900 of the world's leading financial institutions and fintechs trust Alloy for smarter risk management that drives growth.

Through our values: Be Bold, Go Fast, Collaborate, and Celebrate Our Differences, we are creating a workplace where you can grow, thrive, and belong.

See how we've been continuously recognized and named one of Inc. Magazine's Best Workplaces, Forbes America's Best Startup Employers, Best Fintech to Work for by American Banker, year after year.

Check out our investors and read more about us here.

About The Team

The IT and Security team controls who and what can reach Alloy's systems, from the laptops our people use to the SaaS tools and AI agents they work in. Our customers are banks and fintechs, and our ISO 27001 and SOC 2 programs depend on access controls that hold up under audit. We run as a shared-responsibility team: each engineer is the go-to expert in their area and backs up teammates across the rest.

Alloy operates in a hybrid-work environment. Given the internal client-facing nature of this role, the in-person office attendance requirement is four days per week (Tuesday-Thursday, with your choice on whether the fourth in-person day is Monday or Friday).

What you'll do

You’ll own workforce identity at Alloy, from how access is granted and automated to how it is reviewed and removed. You’ll be the primary expert for Okta, SaaS access, and identity automation while sharing coverage for broader IT and Security work.

• IAM and Okta Administration: Serve as the primary technical SME for workforce identity and access management, including Okta groups, policies, application assignments, admin roles, MFA, and authentication controls.
• SaaS Access and Integrations: Manage SaaS access and application onboarding. Implement and maintain SSO integrations using SAML/OIDC, SCIM provisioning and deprovisioning, and Google Workspace access.
• Identity Lifecycle and Automation: Maintain and improve employee and contractor joiner/mover/leaver workflows from our HRIS through our IdP and downstream SaaS. Use Okta Workflows and other automation to cut manual access processes.
• Access Operations: Troubleshoot authentication and provisioning issues, administer temporary access and exceptions, and make access requests more reliable and efficient.
• RBAC Management: Refine, manage, and evolve Alloy's approach to role and attribute based access control.
• Privileged Access Management: Mature PAM/TPAM for administrator and production resource access, including just-in-time and temporary access and break-glass procedures.
• Non-Human Identity Management: Improve ownership and lifecycle controls for service accounts, system users, API credentials and tokens, OAuth applications, bots, and integrations.
• AI Identity and Access: Shape identity and delegated-access controls for AI platforms, AI agents, and MCP integrations, including the scope of access available to tools and agents.
• Access Governance and Compliance: Strengthen least privilege and RBAC/ABAC, run access and privileged-access reviews, remediate stale or orphaned accounts, enforce contractor access expiration, and provide IAM evidence for ISO 27001 and SOC 2.
• Shared IT/Security Engineering: Take on endpoint security, EDR, DLP, application control, email security, SaaS/security tools, and other IT/Security projects within a shared-SME and backup-coverage model.
• Incident Response and Collaboration: Investigate incidents involving identity, users, endpoints, email, and SaaS. Coordinate with teammates and business partners, and keep processes and documentation clear.
• On-call Rotation: Join the IT and Security on-call rotation, responding to critical alerts and urgent after-hours support requests.

What we're looking for

Must-haves

• Hands-on experience in IT or security engineering, with significant responsibility for Okta or a comparable workforce identity provider
• Experience administering IdP groups, access and authentication policies, SaaS application assignments, MFA, and administrative roles
• Experience implementing and troubleshooting SAML/OIDC SSO, SCIM provisioning, and OAuth-based integrations
• Experience running employee and contractor identity lifecycles across HR systems, an IdP, Google Workspace, and downstream SaaS applications
• Ability to automate access workflows using Okta Workflows, APIs, scripts, or comparable tools
• Understanding of least privilege, RBAC/ABAC, access reviews, and account lifecycle controls
• Working familiarity with endpoint security, EDR, DLP, email security, and SaaS security tooling, and willingness to work beyond IAM
• Strong troubleshooting, documentation, and communication skills in a shared-responsibility IT/Security team

Nice-to-haves

• Experience with temporary privileged access management platforms
• Experience governing non-human identities, service accounts, API credentials, and OAuth applications
• Familiarity with identity and delegated access for AI tools, agents, and MCP integrations
• Experience with ISO 27001 or SOC 2 controls in a fintech, SaaS, or other regulated environment

Alloy is committed to fair and equitable compensation practices

Below is the anticipated starting base compensation range for this role; however, pay may vary depending on job-related knowledge, in-demand skills, relevant experience, and/or geography. In addition to a competitive base salary, this position is also eligible for equity awards in the form of stock options (ISOs) as well as a competitive total benefits package.

This position has a base salary range of $162,000 – $190,000.

Benefits and Perks

• Unlimited PTO and flexible work policy
• Employee stock options
• Medical, dental, vision plans with HSA (monthly employer contribution) and FSA options
• 401k with 100% match up to 4% of annual employee compensation
• Eligible new parents receive 16 weeks of paid parental leave
• Home office stipend for new employees
• Annual learning & development stipend
• Well-being benefits include access to ClassPass, OneMedical, UrbanSitter, and Spring Health
• Hybrid work environment: our employees local to NYC are expected to work Tuesdays through Thursdays from our HQ in Union Square, Manhattan. Tasty lunches catered from a variety of local restaurants and frequent employee-organized cultural events contribute to our positive office energy. On Monday/Friday, most employees Zoom into work from home while some take advantage of the quieter office.

Alloy is proud to be an equal-opportunity workplace and employer. We're committed to equal opportunity regardless of race, color, ancestry, religion, gender, gender identity, parental or pregnancy status, national origin, sexual orientation, age, citizenship, marital status, disability, or veteran status. We are committed to an inclusive interview experience and provide reasonable accommodations to applicants with visible and invisible disabilities. We encourage applicants to share needed accommodations with our recruiter.

All Alloy jobs are listed on our careers page. Any communication during the recruitment process, including interview requests or job offers, will come directly from a recruiting team member with an alloy.com email address. We do not use outside applications or automated text messaging in our recruiting process. We will not ask for any sensitive financial or identification information during the recruiting process. If you're ever unsure, please contact us directly via our website before sharing personal information.