Software Engineer (Identity)

Hadrian; New Mexico; On-site; USD 180,000 - 240,000; Full time

Benefits offered by this job

Relocation stipend

Premium medical/dental/vision/Life

401k

Flexible vacation

Job summary

Hadrian is seeking a Senior Identity Engineer to own end-to-end identity programs across corporate, cloud, and factory systems. You will design, implement, and operate IdP stacks, ensuring secure, scalable access using OAuth 2.0, OIDC, and SAML.

You will own cloud identities (Azure/AWS) and workload identity, driving least-privilege access while enabling engineers to move fast. This hands-on IC role sits on a small security team in Los Angeles.

Qualifications

• Hands-on, IC role on a small, high-leverage security team.
• Experience designing and operating IdP stacks.
• Strong understanding of modern identity models and protocols.

Responsibilities

• Design, implement, and operate IdP stack (Okta/Entra/Google Workspace/Auth0/Zitadel).
• Build identity systems at scale using OAuth 2.0 / OIDC / SAML.
• Own cloud identity end-to-end (Azure/AWS) and workload identity.
• Automate joiner-mover-leaver processes and access reviews.
• Collaborate across teams to meet identity needs and automate lifecycles.
• Partner with Detection & Response and Compliance for audit-ready telemetry.

Skills

Identity engineering

SSO

MFA

RBAC

ReBAC

OAuth 2.0

OIDC

SAML

Cloud identities

Automation

Tools

Okta

Entra

Google Workspace

Auth0

Zitadel

Azure IAM

AWS IAM

HashiCorp Vault

Job description

• As our Senior Identity Engineer, you will own workforce and workload identity end-to-end — SSO, MFA, the joiner-mover-leaver lifecycle, privileged access, secrets, and service/machine identity — across corporate, cloud, and factory systems that handle export-controlled technical data
• You will build an automation-first, least-privilege identity program that shrinks our largest attack surface while keeping engineers fast. This is a hands-on individual-contributor role on a small, high-leverage security team in Los Angeles
• Design, implement, and operate our IdP stack (e.g., Okta, Entra, Google Workspace, Auth0, or Zitadel) — SSO, SCIM provisioning, and phishing-resistant MFA — and build the systems around it
• Build identity systems at scale that put OAuth 2.0 / OIDC / SAML and modern authorization models (RBAC and relationship-based access control) to work in production
• Own cloud identity end-to-end — Azure service principals, AWS IAM, and workload/service identity — and tie those identities cleanly to the underlying infrastructure
• Work cross-functionally to help other teams meet their identity needs, and automate the access lifecycle (joiner-mover-leaver) and reviews
• Partner with Detection & Response and Compliance/FSO so identity telemetry is detectable, actionable, and audit-ready

Benefits

• Relocation stipend if you’re moving from outside of LA
• 100% coverage of platinum medical, dental, vision, and life insurance plans for employees
  401k
• Flexible vacation policy

Hands-on depth with one or more IdPs (Okta / Entra / Google Workspace / Auth0 / Zitadel), since day-to-day is implementing, designing, and integrating these platforms

Real command of core identity concepts — OAuth 2.0 flows, OIDC, SAML, RBAC, and relationship-based access control (ReBAC) — and the ability to design systems that exploit these protocols well

Cloud identity depth — Azure service principals, AWS IAM — and a clear grasp of how those identities map to real infrastructure

You can build. Strong software engineering fundamentals and a track record of shipping identity systems at scale — not just configuring a vendor tool or leaning on AI-assisted coding

The autonomy and urgency to own the identity domain end-to-end on a small, high-leverage team with minimal direction

Fine-grained authorization at scale (ReBAC with OpenFGA / Zanzibar-style systems) built and run in production

Identity engineering for OT/manufacturing or other regulated, controlled environments

Large-scale passkey/FIDO2 or PAM (CyberArk/Teleport) rollouts, and secrets management with HashiCorp Vault

Experience building on a small, high-automation team where output-per-engineer is the measure; detection-engineering and ITAR-aware access design