Lead Platform Engineer, Webflow

• Minimum of 8 years in identity, platform, or infrastructure engineering, including ownership of a workforce identity platform at meaningful scale
• Deep hands on experience architecting an enterprise identity provider, with Okta strongly preferred
• Fluency in SAML, OIDC, OAuth 2.0, and SCIM, including debugging at the token and assertion level
• Experience with identity governance, including RBAC design, HRIS driven lifecycle automation, and meeting audit requirements
• Strong grounding in Zero Trust and identity based attacks, including device trust and the security of non human identities
• Scripting ability (Python, JavaScript, or similar) and infrastructure as code experience, such as Terraform
• Clear communication with senior and executive audiences, including driving architecture decisions
• You’ll thrive as a Lead Platform Engineer, Identity & Access if you:
• Design like an attacker, asking how every control could fail or be abused, and respect that one policy change can lock out the whole company
• Get results with Security, HR, and application owners through influence, not authority
• Care as much about adoption as correctness
• Bring order to an under managed environment without waiting for a perfect plan
• Use AI tools with good judgment
• Are comfortable as the lead identity expert, mentoring others and setting the standard
• Stay curious and open to growth — demonstrating a proactive embrace of AI, and actively building and applying fluency in emerging technologies to elevate how we work, drive faster outcomes, and expand collective impact

Desirable

• Webflow is looking for a Lead Platform Engineer, Identity & Access to own how our workforce, devices, and automations authenticate and get access to what they need
• Okta is our primary identity platform, and you’ll take it from a tool that works to a platform that is deliberately architected, governed, and easy to build on
• You’ll partner extensively with Security on policy, risk, and detection, bringing the engineering depth to turn their requirements into systems that run reliably
• Making access safe by default without slowing people down is the central challenge of the role
• Reporting to the Senior Director, Information Technology
• Own the identity architecture and roadmap for workforce identity, with Okta as the core platform, including build versus buy decisions
• Bring our Okta tenant under proper management, with configuration standards, hardening, change control, and configuration as code (Terraform, APIs, Okta Workflows, or scripts where the platform falls short)
• Automate the identity lifecycle from joiner to leaver, using our HRIS as the source of truth and SCIM to downstream applications
• Build paved roads for application onboarding, including standard SSO patterns, provisioning templates, and federated access to our cloud and source control platforms, so app owners can integrate without platform team involvement
• Design the access model: role based access control (RBAC), least privilege, request and approval workflows, and access reviews, with tooling that answers “who has access to what, and why” and produces audit evidence automatically
• Strengthen how access is granted through phishing resistant MFA, device trust and risk signals, and governed non human identities (service accounts, tokens, OAuth grants, and AI tools and agents), and stream identity telemetry to Security for detection and response
• Serve as the top escalation point and primary responder for identity incidents and outages should they arise, including on call coverage for critical identity services, post incident reviews, and log analysis with Security
• Manage the Okta vendor relationship, licensing, and cost

• Application deadline: applications accepted on an ongoing basis until position is closed and filled