Requirements

8+ years of hands-on Linux systems engineering in large-scale, high-availability production environments.
Strong background in identity and access management and security principles such as zero trust, least privilege, just-in-time and just-enough access.
Experience with production services on Kubernetes, Teleport, SPIFFE/SPIRE, HashiCorp Vault, or equivalents.
Good understanding of PKI, short-lived certificates, and mTLS.
Deep knowledge of LDAP, Linux authentication stack (SSSD, PAM, SSH), and identity protocols like OIDC, OAuth 2.0, and SAML.
Experience with configuration management tools (Puppet, Ansible) and scripting/programming in Bash, Python, or Go.
Clear communication skills for explaining access and security decisions to technical and non-technical stakeholders.
Hands-on experience with Infrastructure as Code (IaC).

Nice to Haves

Experience with IAM in regulated environments such as financial services (PCI DSS, DORA).
Experience with Attribute-Based Access Control (ABAC) systems.
Familiarity with policy-as-code tools such as OPA, Cedar, and RBAC.

Maintain and improve IAM infrastructure for humans, systems, and AI agents across on-premise and cloud environments using tools like Teleport and SPIFFE/SPIRE.
Work with zero trust, just-in-time, and just-enough access principles; define, refine, and enforce access policies.
Collaborate with Security and Compliance teams on access reviews, audits, and system hardening.
Support core infrastructure components including LDAP, Puppet, Ansible, and mail infrastructure ensuring stability, security, and low maintenance.
Act as an escalation point for access and infrastructure issues, participate in a blameless on-call rotation, and help teams resolve incidents.
Share IAM and security knowledge within the team and broader engineering organization.