About the RoleLocation: New York, Houston, San Francisco or Seattle
• We're hiring a Senior Identity Platform Engineer to make Okta Nscale's single front door: phishing-resistant sign-in only, no usable password, and identity infrastructure managed as code.
As a Senior Identity Platform Engineer, you'll deliver our passkey rollout, integrate identity verification into onboarding and recovery, and bring Okta configuration under Terraform. You'll work alongside an existing Staff Okta engineer, who remains the senior technical voice on Okta. This is a hands-on delivery role with day-to-day ownership of Okta Workforce Identity.
What you'll be doingOkta platform and automation- Own Okta Workforce Identity day to day, including sign-on and authentication policies, device assurance, admin roles, groups, and app integrations using SAML, OIDC and SCIM.
- Bring Okta configuration under Terraform, with peer review, testing and staged releases.
- Build joiner, mover and leaver automation from Workday through Okta using Okta Workflows and APIs.
- Support federation between Okta and Auth0 for staff access to customer platforms.
Passwordless sign-in- Lead the move to passwordless sign-in: roll out device-bound passkeys and Okta FastPass for everyone, use FIDO2 hardware keys where mandated, and enforce policies group by group until nobody can sign in with a password.
- Design recovery so that access is restored through identity verification, rather than a help-desk reset or a link to a personal inbox.
Verified onboarding and recovery- Integrate an identity verification service using government ID and a liveness check into onboarding and account recovery.
- Ensure the first passkey and every recovery start from a verified identity.
KPIs- Phishing-resistant sign-in enforced for everyone; no password sign-in available
- Verified identity before first-passkey enrolment and every account recovery
- Okta configuration managed through Terraform, peer review, testing and staged releases
About You- 5+ years in identity or platform engineering, including at least 2 years running Okta in production at scale.
- Hands-on experience rolling out passwordless authentication using FIDO2/WebAuthn, passkeys, Okta FastPass or similar, including recovery design.
- Experience with Okta Workflows, Okta APIs and SCIM, plus Terraform's Okta provider or similar configuration-as-code tooling.
- Experience with HR-driven provisioning, ideally from Workday.
- Scripting skills in Python, Go or similar, and experience using Git and code review.
Nice to have- Experience integrating identity verification services such as Persona, Incode, iProov, Nametag or similar.
- Experience with Auth0.
- Google Workspace administration experience.
About the RoleWe're hiring a Staff Security Engineer focused on Privileged Access and Access Automation to build Nscale's privileged access operating model across enterprise systems, SaaS administration, infrastructure, production environments, source control, data platforms, and emergency access paths.
This role sits inside the identity control plane and is intentionally execution-focused. You'll work across Identity, Endpoint, Security Data, Network Security, Platform Engineering, IT, and service owners to turn privileged access into a practical engineering mechanism with request, approval, justification, time-bound elevation, session or event evidence, automated revocation, break-glass, and clean audit trails.
This role is critical because standing privilege is one of the highest-risk patterns in a fast-growing infrastructure company. Your work will help make privileged access secure, fast, measurable, and recoverable so engineers can move quickly without relying on manual reviews, tribal knowledge, or permanent admin rights.
What you'll be doingPrivileged Access Workflows- Build privileged access workflows across enterprise SaaS admin roles, production systems, cloud consoles, infrastructure management systems, source control, data platforms, endpoint admin, and emergency access paths
- Design access patterns that support request, approval, justification, time-bound elevation, and automated revocation
- Define practical controls that reduce reliance on permanent admin rights across high-risk environments
- Establish clean audit trails for privileged access activity across critical systems
JIT Access and Governance Controls- Implement JIT access patterns with approval, justification, expiry, revocation, and evidence collection
- Create a privileged access baseline that defines who can approve access, what justification is required, how long access lasts, what evidence is captured, and how revocation works
- Own exception governance for access paths that cannot yet meet the standard
- Drive entitlement cleanup and stale privilege reduction through automation
Break-Glass and Tiering Model- Design break-glass access standards, ownership models, monitoring, and recovery procedures
- Test emergency access workflows and validate break-glass readiness
- Develop a tiering model for privileged access covering Tier 0 and Tier 1 systems, admin paths, sensitive groups, service-owner roles, and high-risk workflows
- Identify the top 10 highest-risk standing privileges and create remediation paths
Telemetry, Detection, and Measurement- Define privileged access telemetry requirements for detection, investigations, audit, compliance, and executive reporting
- Partner with Security Data to establish privileged access detections and source-health requirements
- Track metrics including standing privilege reduction, JIT adoption, stale admin cleanup, break-glass test success, approval SLA, and access review closure
- Build an inventory of top admin paths, owners, approvers, access methods, logging, expiry, and current risk
KPIs- Standing privilege reduction
- JIT adoption
- Stale admin cleanup
- Break-glass test success
About You- 7+ years in identity security, privileged access, security engineering, infrastructure security, or related engineering roles
- Hands-on experience designing or operating privileged access, JIT, break-glass, access request, approval, or access review workflows
- Strong understanding of authentication, authorization, RBAC, SSO, MFA, access governance, admin tiering, and least privilege
- Experience automating access workflows, entitlement cleanup, evidence collection, or revocation processes
- Strong scripting, workflow automation, API integration, or platform engineering skills
- Ability to translate access risk into practical controls that engineering and operations teams will adopt
- Ability to work across enterprise systems, production environments, SaaS platforms, IT, infrastructure, and compliance stakeholders
- Experience with service accounts, non-human identities, workload identities, API tokens, automation accounts, or secrets governance
- Experience securing production access, source control administration, data platforms, cloud administration, or endpoint admin workflows
- Experience designing access evidence for audit, customer assurance, or incident response
What we can offer youAt Nscale, you'll find a collaborative, supportive, and innovative environment where your contributions spark real impact. We're building something extraordinary, and we want you at the core.
- Highly competitive US compensation package (base + bonus + equity), with performance reviews every 12 months.
- Join one of the fastest-growing AI infrastructure companies - your chance to directly shape how global AI capacity is planned and deployed. •
- Expect a dynamic progression plan tailored to your ambitions. Grow by leading critical cross-functional initiatives and shaping capital strategy - always with our full support.
- Human-First Flexibility: We treat you as humans first. Our flexible workplace trusts Nscalers to deliver, giving you the autonomy to shape your day around life's moments.
