Sr. Identity Engineer, Google Cloud and DevOps

Sr. Identity Engineer, Google Cloud and DevOps to support our client as part of its IAM Modernization program.

In this role, you will join Client’s Cloud Platform team and help modernize identity and access management across the cloud platform. You will lead identity and access protection for Google Cloud and DevOps services, own single sign-on and federation across the platform, and help engineers develop the skills and patterns needed to support the solutions you build., * Design, build, and support Google Cloud Platform infrastructure and CI/CD pipelines using Terraform and GitOps, enabling application teams to deploy and manage workloads on Google Kubernetes Engine (GKE).

• Own single sign-on and federation across the platform, connecting the enterprise identity provider, such as Ping, with Google Cloud and platforms including GitLab, Artifactory, and HashiCorp Vault using SAML and OIDC.
• Implement Google Cloud Workload Identity and Workload Identity Federation so pipelines and microservices can securely access Google services without relying on long-lived keys.
• Manage Google Cloud Platform IAM roles, groups, and least-privilege access patterns mapped to enterprise identity groups.
• Maintain HashiCorp Vault integrations supporting secrets management, dynamic credentials, and PKI.
• Operate and support shared platform services, including GitLab, Artifactory, Vault, and the observability stack.
• Partner closely with identity, security, cloud, and engineering teams as the IAM Modernization program progresses through its implementation waves.
• Develop runbooks and reusable technical patterns, document solutions, and mentor engineers so they can successfully operate and evolve the platform.

• 7 to 10+ years of infrastructure, platform, or DevOps engineering experience, including several years supporting production workloads on Google Cloud Platform and GKE.
• Strong hands-on experience with Terraform and the gcloud CLI. This Google Cloud Platform environment is managed as code rather than primarily through the Google Cloud console.
• Experience with Google Cloud Workforce Identity Federation and Google Cloud Directory Sync (GCDS).
• Deep knowledge of SAML 2.0 and OAuth, including hands-on identity provider integration experience with Ping, Okta, Microsoft Entra ID, or similar platforms.
• Strong Google Cloud service account management experience, including keyless authentication using Workload Identity and Workload Identity Federation.
• Scripting experience with Python and PowerShell. Bash experience is a plus.
• Hands-on GitOps experience using Flux or Argo CD, along with Helm.
• Experience with HashiCorp Vault, Kubernetes RBAC, and OIDC authentication.
• CI/CD experience with GitLab CI or Jenkins and artifact management using Artifactory.
• Experience with Prometheus-based monitoring and observability.
• Demonstrated ability to work effectively within a large, change-controlled enterprise environment.
• Strong written and verbal communication skills, with a collaborative approach and a willingness to teach and mentor other engineers.

Nice to Have

• Experience integrating Ping, CyberArk, or ServiceNow.
• Experience with cert-manager and external-dns.
• Puppet or similar configuration management experience.
• Previous experience working in healthcare or another highly regulated industry.