OverviewInstacart's IT organisation empowers every employee to work securely, reliably, and at scale. We're looking for a Staff Corporate Engineer to define the technical strategy and architecture for our security-critical workforce platforms, including our Okta identity platform, device trust programme, and office networks across San Francisco, New York City, and Toronto.
In this role you will set the long-term technical direction for identity, access, and network infrastructure - establishing the architectural frameworks, engineering standards, and automation blueprints the team builds against. You will serve as the technical authority across Corporate Engineering and drive cross-functional alignment with Security Engineering, Enterprise Applications, Workplace, Compliance, and Help Desk. Your influence will extend beyond your immediate team, identifying high-impact initiatives and shaping how Instacart approaches workforce security and reliability at scale.
This is a senior individual contributor role for someone who combines deep technical expertise with the ability to think in systems, lead without authority, and make sound architectural decisions on high-stakes platforms. Remote-friendly within North America. Occasional travel to Instacart offices may be required (up to 10%).
About the Job- Define and own the long-term identity architecture strategy for Instacart, setting the technical direction for our Okta identity platform including Okta Identity Governance (OIG), lifecycle management, SCIM provisioning, SSO integrations (SAML/OIDC), MFA, risk-based policies, and device trust. Establish the architectural patterns and governance frameworks the team builds against.
- Establish and own the IaC engineering standards and platform patterns for identity and access across Corporate Engineering; author the reusable Terraform frameworks, guardrails, and automation blueprints adopted by the team to achieve consistent, auditable, least-privilege provisioning at scale, integrated with HRIS and ITSM systems.
- Define Instacart's office network architecture strategy and target-state design across SF, NYC, and Toronto; drive the evolution to zero-trust segmentation, set observability and capacity standards, and guide vendor strategy across all office locations.
- Own the IT endpoint strategy for MDM (both Mac and Windows) to both implement and secure our workforce endpoints. Consider best in class endpoint management practises and replatform our systems where required.
- Serve as the technical authority for major IT incidents; own post-incident learning programmes, drive systemic architectural improvements that reduce blast radius and incident frequency, and define the incident response standards adopted across the team.
- Identify opportunities to position Instacart Corporate Engineering and IT team at the forefront of AI adoption. This includes building tools to enable the next generation of IT and building beyond a cloud native/SaaS era into the next generation of AI native work.
- Drive the access governance and compliance architecture strategy in partnership with Security Engineering and Compliance; define the frameworks for access reviews, evidence collection, and access risk management that ensure Instacart's posture scales with the business and delivers license efficiency through automated revocation and right-sizing.
- Act as a technical force multiplier across Corporate Engineering and adjacent teams; develop senior engineers, define team-wide engineering standards and documentation practices, and own the technical roadmap for identity and network platforms. Identify and champion high-impact, multi-quarter initiatives that advance the organisation's security and reliability posture.
About YouMinimum Qualifications- 10+ years of experience in corporate IT engineering or a related field, with deep expertise in identity and access management (IAM) and endpoint systems.
- 5+ years of hands-on ownership of an enterprise Okta tenant at scale (5,000+ users), including architecture-level decisions across SSO (SAML/OIDC), SCIM provisioning, MFA, risk-based policies, and device trust.
- 3+ years of experience designing and implementing identity governance and automation using Okta Workflows, Okta Identity Governance (OIG), or an equivalent IGA platform, with demonstrated ownership of org-wide governance frameworks.
- Expert-level proficiency with Infrastructure-as-Code: Terraform required, including experience establishing reusable module frameworks and IaC engineering standards adopted across a team. Proficiency in at least one scripting language (Python, PowerShell, or equivalent) and REST API/webhook integration.
- Experience with endpoint management (MDM) systems in a mixed Mac and Windows environment. Ideally with IaC methodologies being deployed.
- Proven track record of technical leadership across teams, setting architectural direction, defining standards, and driving cross-functional alignment without managerial authority.
- Experience with enterprise network infrastructure (firewalls, routing/switching, wireless) including zero-trust architecture design and multi-site network strategy.
- Strong written and verbal communication; able to articulate technical strategy and architectural trade-offs to both engineers and business stakeholders.
Preferred Qualifications- Experience working in a high-growth, distributed-workforce environment where workforce security platforms must scale rapidly across new geographies.
- Familiarity with compliance frameworks (SOC 2, ISO 27001) and the ability to translate controls into durable technical implementations.
- Prior experience as a staff-level or principal engineer in a Corporate Engineering or Enterprise IT function.
#LI-Remote
Instacart provides highly market-competitive compensation and benefits in each location where our employees work. This role is remote and the base pay range for a successful candidate is dependent on their permanent work location. Please review our Flex First remote work policy here. Currently, we are only hiring in the following provinces: Ontario, Alberta, British Columbia, and Nova Scotia.
Offers may vary based on many factors, such as candidate experience and skills required for the role. Additionally, this role is eligible for a new hire equity grant as well as annual refresh grants. Please read more about our benefits offerings here.
For Canadian based candidates, the base pay ranges for a successful candidate are listed below.
CAN
$168,000-$177,500 CAD
