Senior Security Engineer - Identity and Access Management

marqeta-inc; United States; Remote; USD 96,000 - 120,000; Full time

Benefits offered by this job

Remote-first (Ontario/BC)

Base salary CAD 136,800–171,000

Annual bonus program

Health insurance options

Flexible vacation time

Floating holidays

Retirement savings with employer 贡献

Equity in a publicly-traded company

Monthly remote-work stipend

Annual professional development

Family-forming benefits

Parental leave with top-up

Job summary

Marqeta Inc. seeks a seasoned Senior Security Engineer to lead an IAM program in a cloud-native environment, combining hands-on engineering with strategic leadership across infrastructure, SaaS platforms, and AI/ML workloads.

This remote role supports candidates in Ontario or British Columbia, Canada, with a CAD salary range and annual bonus. The position includes health insurance options, flexible vacation, retirement savings, stipends, and family-friendly benefits.

Qualifications

• 8+ years of relevant IAM experience with a Bachelor's degree or equivalent.
• Hands-on experience with IAM platforms (Okta, CyberArk, Ping, SailPoint).
• Deep knowledge of AWS IAM and federation patterns.
• Strong scripting skills (Python, PowerShell) and IaC (Terraform, CloudFormation).
• Familiarity with authentication and authorization protocols (SAML, OAuth2, OpenID Connect, Kerberos).
• Knowledge of directory platforms like Active Directory and LDAP; familiarity with compliance frameworks (NIST, SOC 2, PCI DSS).

Responsibilities

• Build and mature IAM governance capabilities including provisioning, de-provisioning, and access reviews.
• Implement and operate PAM controls for cloud-first infrastructure.
• Architect certificate lifecycle management for cloud-native services.
• Integrate IAM across clouds, SaaS platforms, and DevOps pipelines using IaC.
• Design secure access controls for AI/ML systems across training pipelines, datasets, models, and endpoints.
• Mentor engineers and embed identity controls across the engineering lifecycle.

Skills

IAM platforms

AWS IAM

Scripting (Python/PowerShell)

Infrastructure as Code

Auth protocols

Directory services

Compliance knowledge

Education

Bachelor's degree

Tools

Terraform

CloudFormation

Job description

Role overview

Seeking a seasoned Senior Security Engineer to lead the design and evolution of an Identity and Access Management (IAM) program within a fully cloud-native environment. This role combines hands-on engineering with strategic program leadership, shaping how access is governed across infrastructure, SaaS platforms, and emerging AI/ML workloads. The position is remote within Ontario or British Columbia, Canada.

Responsibilities

• Build and mature Identity Governance and Administration (IGA) capabilities, including provisioning, de-provisioning, and access reviews.
• Implement and operate Privileged Access Management (PAM) controls tailored to a cloud-first infrastructure.
• Architect a Certificate Lifecycle Management solution supporting cloud-native services and short-lived workloads.
• Integrate IAM across cloud services, SaaS platforms, and developer/DevOps pipelines using infrastructure-as-code.
• Design secure access controls for AI/ML systems, covering training pipelines, datasets, models, and inference endpoints.
• Mentor engineers and partner with Security, DevOps, and Infrastructure teams to embed identity controls throughout the engineering lifecycle.

Requirements

• 8+ years of relevant experience with a Bachelor's degree, or equivalent combination of education and work history.
• Hands-on expertise with IAM platforms such as Okta, CyberArk, Ping, or SailPoint.
• Deep knowledge of AWS IAM, including roles, policies, permissions boundaries, and federation patterns.
• Strong scripting skills (e.g., Python, PowerShell) and proficiency with infrastructure-as-code tools such as Terraform or CloudFormation.
• Familiarity with authentication and authorization protocols (SAML, OAuth2, OpenID Connect, Kerberos) and directory platforms like Active Directory and LDAP.
• Working understanding of compliance frameworks such as NIST, SOC 2, and PCI DSS.

Nice to have

• Relevant certifications such as CISSP, CISM, CIAM/CAMS, or vendor-specific credentials from CyberArk or Okta.
• Broader AWS service experience across Lambda, S3, DynamoDB, RDS, Aurora, SNS, SQS, CloudTrail, CloudWatch, and CodePipeline.
• Experience embedding IAM into CI/CD pipelines and secrets management workflows.

Benefits and work setup

• Remote-first flexibility for candidates located in Ontario or British Columbia.
• Base salary range of CAD 136,800 – 171,000, plus an annual bonus program.
• Multiple health insurance options, flexible vacation time, and floating holidays.
• Retirement savings program with employer contribution and equity in a publicly-traded company.
• Monthly remote-work stipend and an annual professional development stipend.
• Family-forming benefits and generous parental leave with a base salary top-up.