Senior Security Engineer - Workforce Security - Identity, Access and Authorization

Intuit, Inc.; San Diego (CA); Presencial; USD 161 000 - 218 000; Tempo integral

Resumo da oferta

Intuit, Inc. is seeking a Senior Security Engineer to join the Enterprise Identity & Access Management team in San Diego. You will own and build cloud access management systems, including policy engines and authorization services, to enable fine-grained access decisions across AWS and GCP.

The role emphasizes hands-on design and coding across back-end, automation, and front-end components, with a focus on correctness, minimal blast radius, and verifiable security evidence.

Qualificações

• 5+ years of professional experience building and shipping production software with security relevance.
• Full-stack development: back end in Java/Spring and Python; front end in React.
• Deep hands-on experience with AWS or GCP IAM primitives and cloud permission models.
• Production experience with identity and access management: RBAC/ABAC, SSO, SAML, OIDC, OAuth 2.0, and token lifecycle.
• Ability to root-cause complex security issues through deep analysis, not pattern matching.
• Strong automation instincts for control testing, evidence collection, or compliance workflows.
• Datastore/database experience with schema design at scale and latency constraints.
• Experience using AI developer tools and validating their output.
• Strong written and verbal communication; ability to explain authorization decisions to non-engineers.
• BS/MS in CS or equivalent practical experience.

Responsabilidades

• Lead design and delivery of complex cloud access management and fine-grained authorization services.
• Build back-end services, APIs, and policy evaluation paths in Java/Spring, with Python for automation and agent work, and React front-ends.
• Design authorization models: ABAC, RBAC, policy-as-code, just-in-time and time-bound access, workload identity, least privilege.
• Integrate with AWS IAM/STS, GCP IAM, cross-account access, SAML, OIDC, and OAuth 2.0.
• Lead security evaluations and advocate for approaches with long-term value.
• Identify root causes of security risks and remediate access control gaps with clear narratives.
• Threat model what you build: privilege escalation, token replay, policy bypass, and dependent compromise.
• Automate control testing and evidence collection for regulatory controls; own observability post-release.

Conhecimentos

Java

Spring

Python

React

AWS

GCP

ABAC

RBAC

SAML

OIDC/OAuth 2.0

Policy-as-code

Least privilege

Formação académica

BS in Computer Science or related field

MS in Computer Science (preferred)

Ferramentas

AWS

GCP

SAML

OIDC

OAuth 2.0

React

Java

Spring

Python

Descrição da oferta de emprego

Are you passionate about security engineering, identity, and the cloud?

Come join the Enterprise Identity & Access Management team as a Senior Security Engineer. We build and operate the systems that decide who can access what across Intuit's cloud footprint, and we are rebuilding them for a world where access decisions need to be fine-grained, real-time, and provable.

This is a hands-on building role. You will spend the majority of your time in code and in system design, not in coordination. You will owncloud access management, meaning how humans and workloads get, use, and give up access to AWS and GCP, andfine-grained access controls: policy-as-code, authorization services, and entitlement models that replace coarse role checks with decisions we can actually reason about and prove. You will also help us stand up authentication for workforce agentic identity, an area where the industry does not yet have settled answers and you will help define ours.

The work is full-stack. You will design and build the back-end services and policy engines that make authorization decisions, and the front-end experiences that let engineers, access approvers, and auditors understand and act on them. What makes this a security engineering role rather than a general platform role is that the control is the product: correctness, blast radius, and evidence are the requirements, not afterthoughts.

Responsibilities

Design and build

• Lead design and delivery of complex cloud access management and fine-grained authorization services, owning the outcome independently.
• Build back-end services, APIs, and policy evaluation paths in Java and Spring, with Python for automation and agent work, and React front-ends.
• Design authorization models that hold up in practice: ABAC, relationship-based access control, policy-as-code, just-in-time and time-bound access, workload identity, and true least privilege.
• Integrate deeply with AWS IAM/STS, GCP IAM, cross-account access, and SAML, OIDC, and OAuth 2.0.
• Lead security technology evaluations with long-term implications, and make the internal case for approaches worth adopting.

Own the security outcome

• Find root causes of complex security risks rather than patching symptoms.
• Evaluate, report, and remediate access control gaps, and define remediation guidance other teams follow. Pair data with a clear narrative.
• Threat model what you build: privilege escalation, confused deputy, token replay, policy bypass, and dependency compromise.
• Automate control testing and continuous evidence collection for SOX logical access and other regulatory controls. Manual evidence gathering is a bug.
• Own observability, alerting, and monitoring after release, not just at launch.

Use AI as part of the craft

• Integrate GenAI tooling and orchestrate agents across design, development, validation, and operations, holding their output to the same review and testing bar as your own.
• Apply the same security rigor to AI systems, particularly as we build the identity and authorization layer agents will run on.

Execute and lead

• Provide reliable estimates that account for technical risk and team capacity, balancing speed to learn against long-term system health.
• Eliminate systemic roadblocks through cross-functional influence and shape practices that keep quality consistent.
• Own delivery of major projects, managing risks and updating stakeholders before they ask.
• Partner with Product, Design, and internal customers to co-define requirements from inception.
• Define success upfront, track adoption and impact after launch, and drive follow-up iterations.

Elevate the team

• Give actionable feedback on security practices, design, and collaboration, and contribute to teammates’ learning plans.
• Provide clarity amid ambiguity, resolving technical constraints by grounding discussion in customer problems, security principles, and established patterns.
• Surface unresolved challenges to Staff-plus engineers and management early enough to act.

Qualifications

• 5+ years of professional experience building and shipping production software, with meaningful time spent on security-relevant systems.
• Full-stack development experience:
  • Back end:Java and Spring, plus Python for automation, tooling, and AI/agent work
  • Front end:React (Angular acceptable)
• Deep hands-on experience with AWS or GCP, including its identity and access primitives, and a working understanding of how cloud permission models fail in practice.
• Production experience with identity and access management: RBAC or ABAC, SSO, federation (SAML), OIDC, OAuth 2.0, and token and credential lifecycle.
• Demonstrated ability to root-cause complex security issues through in-depth analysis rather than pattern matching.
• Strong automation instincts, including experience automating control testing, evidence collection, or compliance workflows.
• Datastore and database experience, including schema and query design under real scale and latency constraints.
• Experience using AI developer tools and agents in your engineering workflow, including validating their output before it ships.
• Strong written and verbal communication. You will be explaining authorization decisions and security trade-offs to people who did not design the system, including non-engineers.
• BS/MS in Computer Science, a related field, or equivalent practical experience.

Strongly Preferred Experience

• Fine-grained authorization at scale: policy-as-code with OPA and Rego, AWS Cedar, Zanzibar-style relationship-based authorization, XACML, or a purpose-built decision service.
• Cloud entitlement management: AWS IAM policy analysis, permission boundaries, GCP IAM conditions, workload identity federation, and secrets or credential brokering.
• Identity governance: access certification, separation of duties, privileged access management, and least-privilege analysis over real entitlement data.
• SOX or other regulatory logical access controls, including audit evidence automation and continuous control monitoring.
• Threat modeling and secure design review as a regular practice, not an occasional exercise.
• Machine and non-human identity: service accounts, workload identity, and the emerging problem of giving AI agents scoped, revocable, auditable access.
• Building AI-native applications or applying LLMs and agent frameworks to real production problems.
• Agile, Scrum, or Extreme Programming experience.
• A GitHub portfolio or open source contributions you are proud to share.

Intuit provides a competitive compensation package with a strong pay for performance rewards approach. This position may be eligible for a cash bonus, equity rewards and benefits, in accordance with our applicable plans and programs (see more about our compensation and benefits at Intuit®: Careers | Benefits). Pay offered is based on factors such as job-related knowledge, skills, experience, and work location. To drive ongoing fair pay for employees, Intuit conducts regular comparisons across categories of ethnicity and gender.

The expected base pay range for this position is:

San Diego $161,000 - $218,000