Senior Security Engineer, Identity
Ramp · New York, NY (HQ)
About this role
**Senior Security Engineer, Identity — Ramp** ## About Ramp Ramp is building smart infrastructure for finance teams, embedded in the transaction flow of every dollar a business spends. We automate how **$275B+** in annualized spend flows in and out of **85,000+ companies**—authorizing payments, flagging risk, categorizing spend, and closing books. ## About the Role Corporate Security at Ramp owns the identity and access layer for the company: **Okta, Google Workspace, the SaaS applications behind them, and the governance** that decides who holds what. We’re hiring a **Senior Security Engineer, Identity** to turn that layer into **IAM as a service**—a platform the rest of Ramp can use without filing a ticket. You’ll be hands-on: design how identity works at Ramp and write the code that implements it, including **Terraform-based identity configuration**, **entitlements governed through an agentic workflow**, and an **on-call agent** that answers access questions before anyone has to ask a person. ## What You’ll Do - **Own Terraform** for identity services: Okta applications, authorization servers, authentication policies, groups/group rules, and **SCIM provisioning** - **Design and operate custom authorization servers**, including audiences, scopes, claims, and access policies for internal services and **AI agents** - Implement **app-to-app and agent access** via **Cross App Access (XAA)** and **ID-JAG** so delegated access is brokered and governed by the IdP - **Own the IGA platform**: entitlement catalog, ownership, access requests, time-bound grants, and certifications - Build the **agentic workflow** that takes teams from “we need access” to a defined, owned, and governed entitlement (with Terraform + IGA changes opened for review) - Build **identity graphs** with ISPM tooling to find overprivileged and long-standing access across human and non-human identities - Build the **identity data lake** behind an on-call agent that can explain Okta events (e.g., “User Not Assigned Application”) before a ticket is opened ## What You Need - **6+ years** in identity engineering / IAM, including operational ownership of **Okta (or equivalent)** at scale - Deep understanding of **OAuth 2.0, OIDC, SAML, and SCIM**, including custom authorization servers and how they enforce **aud/scope/claims** - Working knowledge of **XAA and ID-JAG** (token exchange, JWT bearer grants) - Experience with **ISPM / identity graph tooling**, and turning findings into automated remediation - Experience owning an **IGA platform** (or building an equivalent in-house) - **Terraform** experience managing identity providers (module design, state, CI) - Programming in **Python or Go**, with experience building against platform APIs ## Benefits (Highlights) - Flexible PTO - Health & wellness stipend - Weekly coffee stipend - 401(k) with employer match (US) - Parental leave (up to 16 weeks birthing + bonding / 8 weeks bonding only at 100% pay) - Medical/dental/vision coverage varies by region (US/Canada/UK) ## Notes Ramp will only contact candidates through official **@Ramp.com** email addresses and will never ask for payment or sensitive personal information during the hiring process.
Listing freshness
CronJobs last confirmed this listing 44m ago. If its source stops confirming the opening for seven days, this page is removed from active inventory.