Senior Security IAM Engineer

Overview

We are seeking a Senior IAM Security Engineer to join our Information Security team, working remotely or hybrid if based in Barcelona. The role focuses on architecting, enhancing, and securing the identity and access management (IAM) environment across cloud platforms, SaaS, AI tools, and remote access systems. Emphasis is placed on Terraform-based automation, access workflow engineering, least privilege design, identity risk reduction, and leveraging AI-assisted operational workflows.

Key Responsibilities

• Design and continuously improve scalable IAM architectures supporting cloud-first ecosystems spanning AWS, GCP, SaaS applications, AI platforms, and remote access.
• Lead efforts around federated identity technologies including SAML, OIDC, OAuth, and SCIM, managing workforce access models, least privilege roles, RBAC and ABAC implementations, and centralized access via Okta, AWS IAM Identity Center, and similar tools.
• Partner with cross-functional teams to standardize secure identity/access patterns, minimize permission sprawl, enhance access visibility, and ensure auditability.
• Own and optimize Terraform-driven IAM and access automation including reusable modules for roles, policies, permission sets, group mappings, and onboarding/offboarding workflows.
• Implement policy-as-code practices, state management, drift detection, rollback procedures, and blast-radius-aware change management for safe production IAM modifications.
• Build scalable automation for identity lifecycle operations: provisioning, access requests, group assignments, and reporting via integration with Terraform, Python/Bash/PowerShell scripts, API workflows, CI/CD pipelines, Okta workflows, and ticketing systems.
• Take the lead on initiatives to reduce identity-related risks: controlling excessive privileges, hardening service accounts, enforcing permission boundaries, enabling just-in-time access, managing break-glass scenarios, and investigating suspicious activities using native and third-party tools.
• Advocate and improve Zero Trust access controls, privileged access management integrations, adaptive access, MFA/passwordless strategies, and secure vendor/contractor access.
• Support identity investigations, monitoring, audit readiness, build runbooks, and collaborate with compliance teams for SOC 2 and ISO 27001 alignment.
• Drive AI-assisted identity security workflows, including AI-enabled access review analysis, troubleshooting support, security chatops, intelligent triage, and internal copilot development, ensuring safe adoption with human-in-the-loop controls and audit logging.
• Serve as a technical authority guiding engineering, IT, and platform teams on modern IAM architectures, federation designs, automation strategies, and AI-enabled identity workflows.

Core Experience and Skills

• 8 to 12+ years in IAM security engineering, cloud security, or identity-focused security engineering roles with experience in large-scale cloud environments.
• Expertise in AWS IAM including Organizations, Identity Center, SCPs, CloudTrail, GuardDuty, IAM Access Analyzer, and GCP IAM ecosystem.
• Extensive knowledge of Okta administration for group, app integration, lifecycle, and troubleshooting.
• Deep familiarity with federated identity standards: SAML, OIDC, OAuth, SCIM.
• Strong Terraform skills for creating reusable IAM modules, managing state, and executing safe deployments.
• Proficiency with scripting languages such as Python, Bash, PowerShell and API/workflow automation.
• Solid understanding of policy-as-code and infrastructure as code best practices for secure, scalable IAM solutions.
• Exposure or strong interest in AI-assisted tools like Claude Code, Codex, and agent-driven MCP automation.
• Strong grasp of least privilege principles, RBAC and ABAC models, Zero Trust frameworks, privileged access management, and identity risk mitigation strategies.

Additional Information

The role requires a highly technical and hands-on individual capable of influencing and shaping identity security practices through automation and engineering excellence. The candidate will also support evolving AI-driven operational security models while ensuring compliance and audit readiness.