Google Cloud Platform Identity Engineer

About the Job- We are looking for an experienced Google Cloud Platform Identity Engineer to join one of our enterprise client engagements. The ideal candidate should have strong expertise in Google Cloud Platform IAM, Terraform along with experience working in fast-paced enterprise environments., * Strong hands-on Terraform - authoring, reviewing and shipping IAM through modules and CI/CD.

• Strong hands-on Google Cloud Platform IAM - the policy model, inheritance across organisation, folder and project, and the practical difference between predefined and custom roles.
• Real depth on roles and permissions: able to work out what a role actually confers, spot an over-grant, and substitute a narrower role without breaking the use case.
• Ability to understand Workforce Identity Federation and Workload Identity Federation - how human access federates into Google Cloud Platform from an enterprise identity provider, and how a machine identity exchanges a federated token for Google Cloud Platform access instead of holding a key.

Nice to have

• IAM deny policies.
• IAM Conditions - conditional role bindings.
• Experience removing service-account keys at scale, or running a keyless migration.
• Custom role design and the governance around it.
• Experience operating in large regulated enterprise environment

• We own how identity works on Google Cloud Platform at Client - who can reach what, in which environment, and on what terms.
• You’ll design and build the IAM that lets every person and every workload
• authenticate into Google Cloud Platform without a long-lived credential, expressed entirely as infrastructure-as-code and deployed through pipelines rather than the console.
• This is a hands-on engineering role at the boundary between public cloud and a large regulated enterprise, operating at planet scale.

What you’ll do

• Design and deliver Google Cloud Platform IAM as code - role bindings, custom roles and least-privilege role sets across
• organisation, folder and project scope - authored in Terraform, peer-reviewed and applied by pipeline.
• Manage the entitlements behind Workforce Identity Federation, so enterprise users reach Google Cloud Platform through the firm’s identity provider with their access declared in code rather than granted by hand.
• Wire up Workload Identity Federation for applications and pipelines - binding federated principals onto service accounts so a workload exchanges a token for Google Cloud Platform access instead of holding a key.
• Own the service-account lifecycle: naming, provisioning, ownership, impersonation, and the elimination of static keys.
• Design the role model - the reusable sets of entitlements that map a team or persona to the access it actually needs, so access is repeatable and reviewable instead of bespoke.
• Review access requests against a least-privilege standard: establish what a role genuinely grants, find the tightest role that meets the stated need, and record the decision.

CodeForce 360 is a trusted global IT talent partner helping Fortune 500 companies, system integrators, and enterprise organizations build high-performing technology teams. With over 16 years of industry expertise, we combine speed, precision, and market intelligence to deliver exceptional talent across today’s most in-demand technologies.