Enterprise IAM Security Engineer, Opendoor

• Deep conviction that AI and automation should eliminate manual work, with a proven track record building agentic systems
• Has designed, built, and operated a workforce identity platform at enterprise scale, with deep hands-on Okta engineering expertise: building automation and API-driven integrations on top of the platform
• Has shipped a passkey rollout on Okta at enterprise scale, and knows where WebAuthn and FIDO2 adoption breaks in the real world and how to fix it
• Manages identity infrastructure as code: writes and reviews Terraform, or an equivalent IaC tool, for identity systems, and ships changes through pull requests
• Strong software engineering ability in Python, Go, or TypeScript, building first-party tooling and API-driven automation on top of the identity platform
• Identity-first mindset: SSO, SAML, OIDC, and SCIM provisioning, conditional access, and least privilege applied at scale, across both employees and contractors
• High autonomy; sets the roadmap and the right path forward in ambiguous territory, and personally executes against it
• Business-enablement mindset; success measured by adoption and impact
• Humility and curiosity; builds guardrails and automation that make it easier for other teams to move fast securely

Desirable

• Our Security Engineering team builds intelligent systems that protect Opendoor and our customers while enabling unprecedented engineering velocity
• We apply software engineering and AI to solve security problems across product, infrastructure, and operations, building guardrails precisely where they matter
• Identity is the front door to every system an employee or contractor touches, and this role owns it
• You design and build the platform that decides who gets access to what, and you write the code that runs it
• You own the technical direction for identity and build alongside peer specialists covering the rest of the enterprise security surface
• Own the identity control plane end to end, working alongside peers who own other parts of the enterprise security surface: design, build, and operate the systems that authenticate and authorize every employee and contractor
• Own passwordless authentication (e.g. passkeys) for the workforce, across employee and contractor identities
• Define enrollment rules for which authentication methods are required, optional, or disallowed by population, setting the assurance bar before a user ever reaches session or app-level policy
• Design authenticator assurance tiers and tune session policy: session lifetime, idle timeout, and step-up re-authentication scaled to the risk of what's being accessed
• Build per-application authentication policies that weigh device posture, network context, and risk signals to decide when a phishing-resistant factor or a fresh re-authentication is required, with a fast exception path for when a legitimate user gets stuck
• Own the non-human identity inventory: service accounts, API keys, and workload identities, each tracked, owned, and issued short-lived, federated credentials with automatic expiry
• Treat AI agents as their own identity class: scoped, single-use credentials per action, clear delegation from the human or system they act for, and an audit trail granular enough to attribute every individual action
• Manage identity configuration as code, shipping and reviewing every change through pull requests, so a bad policy change is as easy to revert as it was to ship
• Build first-party tooling that extends commercial identity platforms: lifecycle automation, access governance workflows, provisioning, and custom integrations across the workforce SaaS stack
• Own the technical direction for identity, contribute to the broader security engineering roadmap, and ship the critical infrastructure that strengthens the security posture
• Feed high-fidelity identity telemetry, auth events, anomalous access, lifecycle changes, into the detection and response pipeline, and support incident response when identity is in the blast radius
• Establish secure-by-default standards for new SaaS and AI tools employees adopt, enforced directly at the identity layer
• Mentor engineers across security and IT on identity engineering patterns; build automation and guardrails other teams build on top of