Principal Identity Engineer

Role overview

This is a principal-level role establishing identity as the control plane for security across a large online gaming and entertainment platform. You will be the technical authority on how access is granted, governed, and revoked for every employee, administrator, and machine across the organization. Reporting into security leadership, the position sits inside a 16-person security organization and serves as the first dedicated identity hire, focused on architecture, automation, and governance rather than day-to-day provisioning.

Responsibilities

• Own the security architecture, standards, authentication methods, and roadmap for Microsoft Entra ID as the primary identity provider.
• Design and continuously refine Conditional Access policies that balance strong protection with smooth user experience for a globally distributed workforce.
• Advance the rollout of phishing-resistant, passwordless authentication such as passkeys, certificate-based, and FIDO2 methods.
• Own federation and single sign-on across the SaaS estate using SAML, OIDC, OAuth 2.0, and SCIM provisioning.
• Own the privileged access model with Microsoft Entra PIM, including separate admin identities, just-in-time elevation, and approval workflows, plus break-glass safeguards.
• Automate the joiner-mover-leaver lifecycle so access is granted, changed, and revoked accurately and promptly.
• Build and run access reviews and entitlement governance, partnering with GRC on audit evidence for ISO 27001, SOC 2, PCI DSS, and gaming standards.
• Govern non-human identities including service principals, managed identities, and workload/federated credentials across AWS, Azure, and GCP.
• Serve as the identity authority for the Zero Trust program, aligned to NIST SP 800-207 and the CISA Zero Trust Maturity Model.
• Partner with security operations to make identity signals first-class inputs to detection and response.
• Advise on customer identity and account-security architecture in collaboration with product security and product engineering.

Requirements

• 10+ years in identity and access management, security engineering, or a closely related field, or equivalent practical experience.
• Deep, hands-on expertise with a modern enterprise identity platform, including Conditional Access, PIM/PAM, authentication methods, and identity governance.
• Strong command of identity protocols and patterns such as SAML, OIDC, OAuth 2.0, SCIM, and modern MFA.
• Experience automating the identity lifecycle and integrating identity across a large SaaS and multi-cloud estate.
• Scripting and automation skills with PowerShell, Microsoft Graph API, or Python, plus comfort with Infrastructure as Code.
• A track record of designing least-privilege, just-in-time access in a real production environment.
• Excellent written and verbal communication, able to explain an access decision to an engineer and a risk to an executive.
• Fluency with AI tooling and hands-on experience applying AI to security or engineering work.

Nice to have

• Experience in a regulated industry such as gaming, financial services, or healthcare.
• Exposure to customer identity and access management at scale.

Benefits and work setup

• Competitive compensation package with benefits.
• Flexible vacation allowance.
• Hybrid or remote working environment.
• Equal opportunity employer with a stated commitment to inclusive hiring.