The Team:The IAM Team is a net-new, vanguard group responsible for transitioning DRW away from an organically grown identity infrastructure to a unified, enterprise-grade identity platform.
The Role: We are seeking a Lead IAM Architect to serve as the technical visionary for this modernization effort. You will design the overarching architectural blueprint that successfully decouples AuthN from AuthZ. By bridging commercial IdPs with our highly complex, proprietary trading systems, you will ensure a secure transition from legacy cookie-based sessions to modern zero-trust token exchange.
Key Responsibilities: - Design and own the migration architecture to transition DRW from existing identity solutions to a modern, enterprise IdP. You will lead by doing - writing code, configuring APIs, and building proof of concept integrations.
- Act as the primary technical authority during vendor evaluations, designing "messy data" Proof of Concepts to rigorously pressure-test commercial IdP and IGA tools against our actual infrastructure.
- Design the zero-trust token exchange architecture for internal APIs and microservices, ensuring non-human identities are governed securely.
- Act as the technical diplomat between security, compliance, business, and internal engineering teams. You must translate regulatory and security risks into pragmatic engineering requirements that do not slow down the business.
- Partner with the internal engineering and security teams to ensure the new enterprise IdP seamlessly feeds identities into custom-built internal applications.
Required Qualifications: - Deep architectural expertise in modern identity protocols (OIDC, OAuth 2.0, SAML) and applied cryptography (JWT, JWKS, RS256).
- Proven background as a software or systems engineer. Must be highly proficient in IaC and at least one programming language (Go and/or Python preferred) to build custom glue-code and SDKs.
- Deep understanding of modern machine identity paradigms, including HashiCorp Vault, AWS IAM Roles, OIDC federation for CI/CD pipelines, and ephemeral certificate brokering.
- Exceptional ability to manage non-engineering and security stakeholders. You must be able to push back on vendor fluff, negotiate architectural compromises with stubborn engineering teams, and explain complex identity risks to executive business stakeholders.
- Proven experience untangling legacy technical debt, with a pragmatic approach to using Identity-Aware Proxies (IAPs) as "Last-Mile Adapters" during large-scale migrations.
- Strong system design background with the ability to draw and defend architectures that earn the respect of senior software engineers in a high-speed trading culture.
- Strategic mindset with the ability to navigate ambiguity and map technical identity solutions directly to regulatory/compliance requirements.
The annual base salary range for this position is $150,000 to $200,000 depending on the candidate's experience, qualifications, and relevant skill set. The position is also eligible for an annual discretionary bonus. In addition, DRW offers a comprehensive suite of employee benefits including group medical, pharmacy, dental and vision insurance, 401k (with discretionary employer match), short and long-term disability, life and AD&D insurance, health savings accounts, and flexible spending accounts.
[#LI-LD1] 
