Staff IT Engineer

Headway; New York (NY); On-site; USD 180,000 - 225,000; Full time

Job summary

Headway is hiring a senior Identity and Access Architect to set the direction for our IAM program and own the strategy and roadmap. You will tackle cross-domain architectural challenges across identity, security, and IT platform, and raise the technical bar for engineers building the system.

You will mentor engineers, influence leadership on identity risk, and drive privacy best practices in a regulated (HIPAA / SOC 2 / HITRUST) environment while collaborating with security and software teams.

Qualifications

• Have 7+ years in IAM / identity engineering in fast-paced SaaS environments supporting a distributed workforce with deep Okta expertise.
• Defined the technical strategy and architecture for identity programs, including JML automation and SaaS API integrations via SCIM, OIDC, and SAML.

Responsibilities

• Represent identity in engineering and security strategy; influence architecture and platform decisions.
• Own major identity incidents end-to-end; lead response and postmortems for high-severity events and improve reliability and control.
• Lead the org-wide move to least-privilege/RBAC; define models, rollout sequence, and cross-functional adoption.
• Mentor engineers, set documentation standards, and advise leadership on identity risk, tooling, and investment.

Skills

IAM strategy

RBAC leadership

Okta expertise

Security architecture

Incident response

Mentoring engineers

Tools

Okta

Lumos

Jira

Job description

1 in 4 people in the US have a treatable mental health condition, but most providers don't accept insurance, making therapy too expensive for most people. Headway’s mission is to fix this by building a new mental healthcare system everyone can access. We started by solving the biggest barrier to care: credentialing, claims, payment reconciliation - is a nightmare. We've automated that. But we're going further. Over 75,000 providers across all 50 states run their practice on our software, serving over 1 million patients. We are building the best tools for therapists to run their entire practice, reimagining the experience of finding a therapist, and investing in the platform foundations to enable this at scale. We aren't just a billing layer; we are becoming the platform where care actually happens. We're a Series D company with $325M+ in funding (a16z, Accel, Spark Capital, etc.), looking for exceptional people to help us achieve this mission. We want your time here to be the most meaningful experience of your career. Join us, and help change mental healthcare for the better. Identity and access is foundational to how Headway operates securely at scale. In this role you will set the direction for our identity and access program, resolve the hardest architectural problems where identity, endpoint, security, and the broader IT platform intersect, and raise the technical bar for the engineers around you. You will be deepest in IAM, but you will lead well beyond it.

You’ll Love This Role If You Want To

• Set the multi-year direction for identity and access at Headway. Own the IAM strategy and roadmap (lifecycle, JML automation, IdP architecture) as a group-level program tied to business outcomes, not just a set of workflows to run.
• Represent identity in company-wide engineering and security strategy. Bring a point of view to architecture and platform decisions, and be the person leadership consults on where identity and access should go next.
• Resolve the hard, cross-domain architectural problems where identity, endpoint, security, and the broader IT platform intersect: API/SCIM/OIDC/SAML integration design, RBAC modeling, and device-to-identity trust. Set the patterns other engineers build on.
• Lead the org-wide move to least-privilege / RBAC as a change program: define the model, sequence the rollout, manage user impact, and drive cross-functional adoption across pods so it actually sticks.
• Raise the automation and reliability bar. Architect provisioning, de-provisioning, and access-change automation that eliminates manual toil at scale, and set the standards and guardrails the team builds against, rather than just authoring individual integrations.
• Own major identity incidents end-to-end. Lead response and postmortems for high-severity identity and access events and turn the learnings into durable reliability and control improvements.
• Level up the team. Mentor engineers across IT Engineering, set documentation and quality standards, and advise leadership on identity and access risk, tooling, and investment.

You May Be a Good Fit If You

• Have 7+ years in IAM / identity engineering in fast-paced SaaS environments supporting a distributed workforce, with deep Okta expertise, and enough breadth across endpoint, security, and IT platform to lead beyond identity alone.
• Have defined the technical strategy and architecture for identity programs, not just implemented them, including JML automation and SaaS integration via APIs, SCIM, and OIDC/SAML.
• Have led organization-wide access-control or RBAC deployments as the technical owner, driving cross-functional alignment and managing user impact at scale.
• Set standards other engineers follow. You've established patterns, guardrails, and documentation practices that outlast any single project.
• Represent technical decisions to senior stakeholders and leadership, synthesizing complex tradeoffs into clear direction that drives business efficiency.
• Mentor and grow other engineers, and actively shape team culture, hiring, and onboarding.
• Lead incident response and reliability improvements for identity-critical systems.
• Operate with autonomy and methodical ownership, planning and executing group-level work with visibility, and stay current on identity and privacy best practices in a regulated (HIPAA / SOC 2 / HITRUST) environment.

Tools We Use

• Identity and Access Management: Okta, Lumos
• Email and Messaging: Gmail and Slack
• Document Creation and Collaboration: Google Workspace, Confluence
• Credential Management: 1Password
• Ticketing: Jira Service Desk, ZenDesk, Jira Projects
• Project Planning: Jira
• Endpoint Management: Iru, InTune, ChromeOS, Kolide

We believe a team's strength is in its people, and we cannot achieve this mission without a team that reflects the diversity of this problem – across race, ethnicity, gender, sexuality, age, national origin, religion, family status, disability, military status, and experience. Headway is committed to the full inclusion of all qualified individuals. As part of this commitment, Headway will ensure that persons with disabilities are provided with reasonable accommodations. If reasonable accommodation is needed to participate in the job application or interview process, to perform essential job functions, and/or receive other benefits and privileges of employment, please inform the recruiter when they contact you to schedule your interview.

Headway participates in E-Verify. To learn more, click here.

Compensation Range: $180K - $225K