Senior Security Engineer - Identity and Access Management

marqeta-inc; United States; Remote; USD 98,000 - 123,000; Full time

Benefits offered by this job

Remote-first flexibility

Annual bonus program

Health insurance

Flexible vacation

Equity in publicly-traded company

Remote-work stipend

Professional development stipend

Parental leave with top-up

Family-forming benefits

Job summary

Marqeta, Inc. is seeking a Senior Security Engineer to lead the design and evolution of an IAM program within a cloud-native environment.

The role blends hands-on engineering with strategic leadership to govern access across infrastructure, SaaS platforms, and AI/ML workloads. You will build IAM governance, implement PAM controls, and mentor teams while partnering with Security, DevOps and Infrastructure to embed identity across the engineering lifecycle.

Qualifications

• 8+ years of experience with a Bachelor’s degree or equivalent.
• Hands-on IAM experience with Okta, CyberArk, Ping, or SailPoint.
• Deep knowledge of AWS IAM, roles, policies and federation patterns.
• Scripting in Python/PowerShell and IaC tools (Terraform, CloudFormation).
• Familiarity with SAML, OAuth2, OpenID Connect, Kerberos; AD/LDAP.
• Experience with NIST, SOC 2 and PCI DSS compliance.

Responsibilities

• Build and mature Identity Governance and Administration capabilities (provisioning, de-provisioning, access reviews).
• Implement and operate Privileged Access Management controls for cloud-first infrastructure.
• Architect Certificate Lifecycle Management for cloud-native services and short-lived workloads.
• Integrate IAM across cloud services, SaaS and DevOps pipelines via IaC.
• Design secure access controls for AI/ML systems (training, datasets, models, inference).
• Mentor engineers and partner with Security, DevOps, and Infrastructure teams to embed identity controls.

Skills

IAM platforms

AWS IAM

Scripting (Python, PowerShell)

Infrastructure-as-Code

Authentication protocols

Education

Bachelor's degree or equivalent

Tools

Terraform

CloudFormation

Okta

CyberArk

Ping

SailPoint

Job description

Role overview

Seeking a seasoned Senior Security Engineer to lead the design and evolution of an Identity and Access Management (IAM) program within a fully cloud-native environment. This role combines hands‑on engineering with strategic program leadership, shaping how access is governed across infrastructure, SaaS platforms, and emerging AI/ML workloads. The position is remote within Ontario or British Columbia, Canada.

Responsibilities

• Build and mature Identity Governance and Administration (IGA) capabilities, including provisioning, de‑provisioning, and access reviews.
• Implement and operate Privileged Access Management (PAM) controls tailored to a cloud‑first infrastructure.
• Architect a Certificate Lifecycle Management solution supporting cloud‑native services and short‑lived workloads.
• Integrate IAM across cloud services, SaaS platforms, and developer/DevOps pipelines using infrastructure‑as‑code.
• Design secure access controls for AI/ML systems, covering training pipelines, datasets, models, and inference endpoints.
• Mentor engineers and partner with Security, DevOps, and Infrastructure teams to embed identity controls throughout the engineering lifecycle.

Requirements

• 8+ years of relevant experience with a Bachelor's degree, or equivalent combination of education and work history.
• Hands‑on expertise with IAM platforms such as Okta, CyberArk, Ping, or SailPoint.
• Deep knowledge of AWS IAM, including roles, policies, permissions boundaries, and federation patterns.
• Strong scripting skills (e.g., Python, PowerShell) and proficiency with infrastructure‑as‑code tools such as Terraform or CloudFormation.
• Familiarity with authentication and authorization protocols (SAML, OAuth2, OpenID Connect, Kerberos) and directory platforms like Active Directory and LDAP.
• Working understanding of compliance frameworks such as NIST, SOC 2, and PCI DSS.

Nice to have

• Relevant certifications such as CISSP, CISM, CIAM/CAMS, or vendor‑specific credentials from CyberArk or Okta.
• Broader AWS service experience across Lambda, S3, DynamoDB, RDS, Aurora, SNS, SQS, CloudTrail, CloudWatch, and CodePipeline.
• Experience embedding IAM into CI/CD pipelines and secrets management workflows.

Benefits and work setup

• Remote‑first flexibility for candidates located in Ontario or British Columbia.
• Base salary range of CAD 136,800 – 171,000, plus an annual bonus program.
• Multiple health insurance options, flexible vacation time, and floating holidays.
• Retirement savings program with employer contribution and equity in a publicly‑traded company.
• Monthly remote‑work stipend and an annual professional development stipend.
• Family‑forming benefits and generous parental leave with a base salary top‑up.