Principal Software Engineer (Identity Services)

Principal Software Engineer, Identity ServicesTHE TEAMOur client’s Identity Services team owns Identity and Access Management (IAM) within the company, with a core focus on enabling secure and appropriate administrative access to production and production-adjacent services. The team’s scope spans Active Directory, Okta, Adaxes, bastion and jumpbox implementations, multi-factor authentication, hardware security keys, and a range of other access solutions. This team plays a critical role in protecting privileged access pathways and ensuring production access follows least privilege principles across a high-volume, 24x7 global environment.What makes this team distinctive is that they don’t just configure identity platforms, they engineer them. They build automation, internal tooling, and integrations that make identity services reliable, scalable, and self-healing at the scale of one of the world’s largest live entertainment companies.THE JOBAre you an engineer who thinks deeply about security, builds things that last, and can lead a team while doing it? Our client is looking for a Principal Software Engineer to set the technical direction for their Identity Services function, and to help lead the people who deliver it.This is a hybrid role by design. The majority of your time (~70%) is spent in the Identity function: hands-on building, and owning the strategy, architecture, and roadmap for how they engineer and automate identity infrastructure. The remainder (~30%) is spent leading, mentoring, coaching, and providing day-to-day technical and people leadership for the team. They’re looking for someone who has been a team lead or people manager before and wants to keep their hands on the keyboard: a player-coach, not a full-time manager and not a heads-down IC.You will own the architecture of the IAM tooling and integrations, drive security-first design across the platform, own the Identity Services roadmap, and lead adoption of privileged access principles for production access. Critically, you will do this with a strong bias toward a software-engineering-based solutions approach: what the team builds is production-quality software, designed, tested, observable, and maintainable, not one-off scripts. You set that bar by example, in the code you write and the code you review.If you’re energized by solving hard identity engineering problems, building systems that run at scale, growing the engineers around you, and leaving a permanent mark on how a global platform manages access, this is your role.What success looks like at 6 months: The team is executing against a roadmap you own, with your architectural guidance on identity automation and tooling. You’ve driven meaningful improvement in at least one core area, PAM, compliance reporting, or automated provisioning, and shipped it, not just designed it. Engineers come to you for technical decisions and for growth; you run effective 1:1s and raise the team’s engineering bar measurably. You’ve built trust through delivery, not just direction. Much of the access review and provisioning work is still manual; your first year is turning it into owned software.WHAT YOU WILL BE DOINGWork Distribution ( 70% Identity function / 30% leadership):Hands-On Identity Engineering (35%): Writing and reviewing production-grade code for identity automation, integrations, and tooling. Building the prototype that proves (or kills) an approach. Incident response, debugging, and urgent security fixes when they arise.Strategy, Architecture & Roadmap Ownership (35%): Owning and driving the Identity Services roadmap and long-term technical direction. Designing secure identity architectures, conducting security reviews, implementing and leading PAM strategy. Producing documentation, diagrams, and proofs-of-concept that guide the team’s execution and align identity strategy with the company’s security program objectives.Team Leadership & People Management (30%): Providing day-to-day technical and people leadership, mentoring and coaching engineers, running 1:1s and growth conversations, setting standards, and helping prioritize and unblock the team’s work. Acting as a lead the team trusts and leadership relies on.Identity Engineering & Automation:Design and build internal tooling, APIs, and automation frameworks that make identity operations reliable, repeatable, and self-serviceApply secure software development practices to all IAM tooling, automation, and integrations, writing maintainable, testable, observable code, and holding others’ code to the same standard in reviewBuild and own integrations between identity platforms (Okta, Active Directory, Adaxes) and adjacent infrastructure systemsImplement Infrastructure as Code for identity infrastructure provisioning and lifecycle managementAutomate identity lifecycle workflows: provisioning, deprovisioning, access reviews, and reconciliationDrive adoption of CI/CD practices for identity configuration and tooling deployments via GitLabSet the software-engineering standard for the team, production-quality engineering over scripting; solutions validated with working code, not slidewareSecurity Architecture, Strategy & Roadmap:Own the Identity Services technical roadmap and drive enterprise-wide identity architecture decisionsDesign and implement privileged access management architecture for production access, aligned with enterprise security strategyDevelop the identity security roadmap for production and administrative access aligned with the company’s security programLead privileged access management (PAM) strategy and implementation for production systemsEstablish security metrics and KPIs for production access and privileged identity servicesLead threat modeling for production access pathways and identity infrastructureDesign break-glass procedures, just-in-time access, and temporary privilege escalation workflowsConduct security reviews of authentication and authorization patterns and propose improved designsDesign highly scalable, resilient IAM architecture supporting 24x7 global operationsTeam Leadership & People Management:Provide technical and people leadership for the Identity Services team, fostering a culture of psychological safety, continuous learning, and technical excellenceMentor and coach engineers; run regular 1:1s and career-development conversations that help engineers growSet clear expectations and standards for engineering quality, security, and deliveryHelp prioritize the backlog and remove blockers; balance operational demand against strategic project workParticipate in recruiting, interviewing, and hiring top IAM/engineering talentServe as an escalation point and advocate for the team across the broader technology organizationCross-Team Collaboration & Leadership:Serve as the technical authority for identity engineering across the organizationPartner with Infrastructure Security Engineering and enterprise InfoSec on enterprise identity requirements and security initiativesDrive remediation of identity-related findings from audits and assessmentsCollaborate with platform, application, and development teams to ensure identity services integrate cleanly across the stackCommunicate priorities, progress, risks, and roadmap clearly to senior leadership and adjacent stakeholdersIncident Response & Operational Excellence:Support security incident response with identity and access expertiseImplement preventative measures to reduce identity-related security incidentsDevelop and maintain incident response runbooks for identity services; run tabletop exercisesProactively identify and address stability, capacity, and performance concerns before they become incidentsParticipate in on-call rotation and after-hours support as requiredWHAT YOU NEED TO KNOW (TECHNICAL SKILLS/COMPETENCIES)Required:Prior experience as a team lead or people manager, with direct responsibility for engineer mentorship/development and team delivery, you’ve led people, not just projectsStrong software engineering proficiency in Python and/or Go, beyond scripting and automation glue. You design, build, test, and review production-quality services and tools, and you write maintainable, testable, observable code with an emphasis on securityExpertise in Microsoft Active Directory and related components: Group Policy, LAPS, LDAP, AD-integrated DNSExperience with Privileged Access Management (PAM) solutions and strategiesPractical knowledge of MFA best practices and hardware security key management (e.g., YubiKey)OAuth/OIDC/SAML authentication protocols and their security and engineering implicationsDevOps/SRE experience: GitLab CI/CD, IaC (Terraform, Ansible, or similar), monitoring and alerting (Prometheus, Grafana, Splunk), SRE principlesMust be legally authorized to work in the US; this role is not eligible for visa sponsorshipHighly Desirable:Advanced Okta configuration and security hardening experienceExperience with Adaxes or similar unified Active Directory management platformsFamiliarity with cloud IAM patterns on AWS (preferred) or GCP, with a security and engineering focusExperience with identity verification / IDV platforms (e.g., Persona) and self-service verification flowsExperience designing or building internal developer portals, service catalogs, or self-service access toolingSolid grounding in Zero Trust architecture principles and hands-on implementation experienceExperience working within Agile/SAFe frameworks including sprint planning and PI PlanningUnderstanding of PCI-DSS compliance and security best practices in the context of identity systemsKubernetes and containerization experience (identity workloads increasingly run as containerized jobs/services)Experience with architectures for secure production accessExperience owning a technical roadmap or strategic direction for a service or platformFamiliarity with security frameworks and threat modeling methodologiesExperience managing large-scale Linux & Windows infrastructureContribution to open-source security or identity toolingBackground in API design for identity and access-control integrationsHOW WE WORKSoftware-engineering approach to identity: solutions are validated with working code, not slideware; prototypes are built to graduate into owned, maintained software rather than remain one-off scriptsAI-assisted engineering is standard practice, with the same discipline as always: small focused changes, real review, working demosSignificant autonomy within an Agile (SAFe) environmentHigh-trust, high-visibility work: privileged-access changes, incidents, and audits come with composure, discretion, and rigor attachedYOU (BEHAVIORAL SKILLS / COMPETENCIES)Player-coach: You lead a team and still ship. You get energy from both building great systems and growing great engineers, and you know when each is the jobBuilder’s mindset: You ship things that work, get adopted, and make a lasting differenceSecurity-first: Deeply concerned with the security and compliance implications of your systems; able to balance rigorous security requirements with operational and business needsTechnically authoritative: Extremely knowledgeable on IAM and security subject matter; comfortable making and defending high-stakes architectural decisions and owning the roadmap behind themPeople-first leadership: Genuinely invests in the growth and wellbeing of team members; uses coaching to develop engineers’ problem-solving and careersAutonomous and proactive: Drives your own work forward, identifies problems before they surface, and owns outcomes end-to-endFocused on quality: Committed to security, reliability, observability, and high standards of code quality and maintainability across everything the team buildsINSPYR Solutions provides Equal Employment Opportunities (EEO) to all employees and applicants for employment without regard to race, color, religion, sex, national origin, age, disability, genetics, or any other protected status. INSPYR Solutions complies with all applicable laws governing nondiscrimination in employment in every location in which the company has facilities.Applicants requiring reasonable accommodation during the application or interview process should contact HR@inspyrsolutions.com for assistance.Information collected and processed through your application with INSPYR Solutions (including any job applications you choose to submit) is subject to INSPYR Solutions’ Privacy Policy and INSPYR Solutions’ AI and Automated Employment Decision Tool Policy: https://www.inspyrsolutions.com/policies/. By submitting an application, you are consenting to being contacted by INSPYR Solutions through phone, email, or text.

• Prior experience as a team lead or people manager, with direct responsibility for engineer mentorship/development and team delivery, you’ve led people, not just projects
• Strong software engineering proficiency in Python and/or Go, beyond scripting and automation glue. You design, build, test, and review production-quality services and tools, and you write maintainable, testable, observable code with an emphasis on security
• Expertise in Microsoft Active Directory and related components: Group Policy, LAPS, LDAP, AD-integrated DNS
• Experience with Privileged Access Management (PAM) solutions and strategies
• Practical knowledge of MFA best practices and hardware security key management (e.g., YubiKey)
• OAuth/OIDC/SAML authentication protocols and their security and engineering implications
• DevOps/SRE experience: GitLab CI/CD, IaC (Terraform, Ansible, or similar), monitoring and alerting (Prometheus, Grafana, Splunk), SRE principles
• Must be legally authorized to work in the US; this role is not eligible for visa sponsorship

Highly Desirable:

• Advanced Okta configuration and security hardening experience
• Experience with Adaxes or similar unified Active Directory management platforms
• Familiarity with cloud IAM patterns on AWS (preferred) or GCP, with a security and engineering focus
• Experience with identity verification / IDV platforms (e.g., Persona) and self-service verification flows
• Experience designing or building internal developer portals, service catalogs, or self-service access tooling
• Solid grounding in Zero Trust architecture principles and hands-on implementation experience
• Experience working within Agile/SAFe frameworks including sprint planning and PI Planning
• Understanding of PCI-DSS compliance and security best practices in the context of identity systems
• Kubernetes and containerization experience (identity workloads increasingly run as containerized jobs/services)
• Experience with architectures for secure production access
• Experience owning a technical roadmap or strategic direction for a service or platform
• Familiarity with security frameworks and threat modeling methodologies
• Experience managing large-scale Linux & Windows infrastructure
• Contribution to open-source security or identity tooling
• Background in API design for identity and access-control integrations