Senior Identity Governance Engineer

At ServiceTitan, we are building a next-generation identity fabric, and this role engineers the governance layer on top of it. Identity spans cloud environments, SaaS applications, data systems, machine identities, and now AI agents, which makes it one of the most sprawling attack surfaces in the enterprise. You will make sure every identity, whether a Titan, a third-party contractor, a service account, or an AI agent, has the right access, for the right reason, at the right time, and that we can prove it.

Corporate Engineering (IT) administer our identity platforms, including Okta and Lumos, and run lifecycle operations. InfoSec defines identity governance requirements and validates that controls work. You sit in InfoSec and engineer the governance layer: authentication and authorization design standards, entitlement models, access review automation, and audit-ready evidence. You administer Veza with Corporate Security, Security Architecture, Product Security, and Security Operations, work with Corporate Engineering and System Owners to put governance requirements into practice, and you will be a key owner of our ISPM and IGA program.

What you'll do:

You engineer identity governance: the tooling, automation, and design standards that make access reviewable and provable. Corporate Engineering and IT administer the identity platforms, and InfoSec GRC owns the policies and the review program.

• Access Request Governance: Define governance requirements and design patterns for access request workflows across privileged systems (code repositories, databases, infrastructure), including role-based, time-bound, delegated, and just-in-time access, and measure adoption so access is not granted outside the governed workflow. Corporate Engineering and IT administer Lumos and implement the workflows; you specify the requirements, build the monitoring that detects bypass, and validate that they work.
• Authentication & Authorization Design: Partner with Security Architecture to define authentication and authorization design standards (SSO, MFA and phishing-resistant requirements, OIDC/SAML/SCIM patterns, least-privilege role models) for enterprise tools, and review integrations against them.
• Authorization Governance & Entitlement Design: Provide the technical design for authorization decisions on job functions and privileged data access, including critical systems such as ST Admin roles, Snowflake, Salesforce, and other high-risk entitlements. Build role models scoped to job function and normalize entitlement data across applications in Veza so access can be reviewed like for like.
• Access Review & Lifecycle Automation: Build and operate the tooling and automation behind the user access review program (SOX ITGC, PCI DSS, SOC 1/2, ISO 27001), which InfoSec GRC owns, and behind joiner/mover/leaver control assurance, including leaver access-reversion evidence, reconciliation against the authoritative HR source, and orphaned account detection.
• Privileged Access Governance: Build visibility into standing privileged access across core cloud infrastructure and the data platform and drive it down, moving toward time-bound elevation (PIM and JIT) with governed exceptions for the access that must remain.
• Identity Fabric Architecture: Define the target-state governance architecture across Okta, Veza, and Lumos and the risk-based identity lifecycle it supports. You administer Veza in combination with Corporate Security, Security Architecture, Product Security, and Security Operations, building its data source integrations, policies, and alerts. Corporate Engineering and IT administer Okta and Lumos, and you partner with them on lifecycle and workflow integration.
• ISPM & Continuous Governance: Add continuous monitoring to periodic certifications. Build identity analytics that detect over-privileged accounts, shadow identities, dormant access, and identity drift, and automate remediation workflows with named owners.
• Non-Human Identity & AI Security: Build the inventory and governance workflows for service accounts, API keys, personal access tokens, and AI agents, including ownership, rotation, and attestation requirements, and drive remediation with owning teams. Ensure AI integrations are covered by rigorous entitlement management, in partnership with our AI governance review process.
• Cross-Functional Collaboration: Work with Corporate Engineering, the administrative owner of identity platforms and lifecycle operations, alongside Security Architecture and System Owners to ensure every enterprise tool is integrated with identity by design, while InfoSec GRC defines identity governance requirements and validates control effectiveness.
• Compliance as Code & Audit Support: Provide the technical identity evidence for audit requests (SOX, PCI, ISO 27001, SOC 1/2), partnering with our SOX IT compliance team, who coordinate with auditors. Automate evidence collection so compliance is a byproduct of good engineering, not a manual chore.
• Vendor Engagement: Partner with Corporate Engineering to engage our strategic identity vendors (Veza, Okta, Lumos). Hold vendors accountable to their commitments and service levels, influence their product roadmaps, and secure the implementation and adoption support we need to maximize our return on investment.

What you'll bring:

We are looking for deep identity experience, whether in governance, administration, engineering, or a mix of these, paired with hands-on technical skills. You build the tools that make governance work.

• The Fundamentals: 5+ years in identity and access, with depth in Identity Governance & Administration. Broader experience in identity and access engineering (SSO, provisioning, directory or identity platform automation) is welcome alongside a governance background. You deeply understand lifecycle management (Joiner/Mover/Leaver), RBAC/ABAC and entitlement modeling, Separation of Duties, privileged access governance, and the Principle of Least Privilege, and you can design and automate access certification programs at enterprise scale.
• The Modern Stack: Hands-on experience with modern IGA and identity discovery tools (e.g., Veza for authorization graphs and entitlement visibility, Lumos for SaaS governance and access requests, Okta for lifecycle orchestration and identity governance workflows). Experience administering an authorization graph platform such as Veza is especially valuable, since you will own it in partnership with other security teams.
• Authentication & Authorization Design: Working knowledge of authentication and authorization standards and patterns (SSO, OIDC, SAML, SCIM, MFA, RBAC/ABAC) and the ability to review enterprise integrations against them.
• NHI Governance: Proven experience governing non-human identities (service accounts, API keys, workload identities) in cloud-native environments (AWS/GCP), including inventory, ownership assignment, rotation and expiry requirements, periodic attestation, and risk exception handling. You can read cloud IAM and secrets management configurations and partner with the engineering teams who operate those platforms.
• Security Posture: Understanding of ISPM principles, including detecting identity drift, excessive entitlements, orphaned accounts, and misconfigurations before they are exploited, and turning those findings into governed remediation.
• Compliance Fluency: Ability to translate regulatory and audit requirements (SOX ITGC, PCI DSS, SOC 2, ISO 27001) into identity controls, automated workflows, and audit-ready evidence. You are comfortable working directly with internal and external auditors.
• Automation & Engineering Skills: Proficiency in a scripting language (e.g., Python or Go), plus API integration experience and familiarity with workflow or low-code tooling, to automate access reviews, evidence collection, and remediation tracking.

Who You Are

• A Systems Thinker: You understand the balance between People, Process, and Technology. You don't just fix a ticket; you fix the process that created the ticket.
• An Enabler of Innovation: You believe security should be a tailwind, not a headwind. You build identity governance that lets Titans move faster and collaborate safely.
• Data-Driven: You use identity analytics to find high-risk areas and prioritize work based on actual risk data.

Why This Role Matters

As ServiceTitan scales and integrates AI across our platform, identity governance is what keeps access defensible. Your work protects customer data, supports the trust our customers place in us, and lets our teams move faster with confidence.

What We Offer:

When you join our team, you're not just accepting a job. You're making a career move. Here's how we'll support you in doing some of the most impactful work of your career:

• Flextime, recognition, and support for autonomous work: Flexible time off with ample learning and development opportunities to continue growing your career. We offer a comprehensive onboarding program, leadership training for Titans at all levels, and other programs and events. Great work is rewarded through Bonusly, peer-nominated awards, and more.
• Holistic health and wellness benefits: Company-paid medical, dental, and vision (with 100% employer paid options and 90% coverage for dependents), FSA and HSA, 401k match, and telehealth options including memberships to One Medical.
• Support for Titans at all stages of life: Parental leave and support, up to $20k in fertility services (i.e. IUI and IVF), surrogacy, and adoption reimbursement, on demand maternity support through Maven Maternity, free breast milk shipping through Maven Milk, pet insurance, legal advisory services, financial planning tools, and more.

At ServiceTitan, we celebrate individuality and uniqueness. We believe that the convergence of fresh perspectives and experiences from all walks of life is what makes our product and culture so great. We strongly encourage people from underrepresented groups to apply.