Senior Security Engineer - Workforce Security - Identity, Access and Authorization

Location: San Diego, California or Mountain View, California, United States

Base pay: $161,000–$218,000 annually in San Diego; cash bonus, equity rewards, and benefits may also apply.

Company

hirify.global is a global financial technology platform serving tens of millions of customers through products including TurboTax, Credit Karma, QuickBooks, and Mailchimp.

What you will do

• Lead the design and delivery of cloud access management and fine-grained authorization services across AWS and GCP.
• Build back-end services, APIs, policy evaluation paths, automation, and React front-end experiences using Java, Spring, Python, and React.
• Design authorization models covering ABAC, relationship-based access control, policy-as-code, just-in-time and time-bound access, workload identity, and least privilege.
• Integrate AWS IAM/STS, GCP IAM, cross-account access, SAML, OIDC, and OAuth 2.0.
• Evaluate and remediate access control gaps, threat model systems, automate control testing and evidence collection, and own monitoring after release.
• Use and validate GenAI tools and agents, lead major projects, influence cross-functional practices, and partner with Product, Design, and internal customers.

Requirements

• 5+ years of professional experience building and shipping production software, including meaningful experience with security-relevant systems.
• Full-stack development experience with Java and Spring on the back end, Python for automation, tooling, and AI/agent work, and React on the front end; Angular is acceptable.
• Deep hands-on experience with AWS or GCP, including cloud identity and access primitives and practical understanding of cloud permission-model failures.
• Production identity and access management experience with RBAC or ABAC, SSO, SAML federation, OIDC, OAuth 2.0, and token and credential lifecycle management.
• Ability to root-cause complex security issues through in-depth analysis.
• Experience automating control testing, evidence collection, or compliance workflows.
• Datastore and database experience, including schema and query design under scale and latency constraints.
• Experience using AI developer tools and agents in engineering workflows, including validating their output before release.
• Strong written and verbal communication, including explaining authorization decisions and security trade-offs to non-engineers.
• BS/MS in Computer Science or a related field, or equivalent practical experience.

Nice to have

• Fine-grained authorization at scale using OPA and Rego, AWS Cedar, Zanzibar-style authorization, XACML, or a purpose-built decision service.
• Cloud entitlement management, including AWS IAM policy analysis, permission boundaries, GCP IAM conditions, workload identity federation, and secrets or credential brokering.
• Identity governance experience with access certification, separation of duties, privileged access management, and least-privilege analysis.
• SOX or other regulatory logical access controls, audit evidence automation, and continuous control monitoring.
• Threat modeling and secure design review as a regular practice.
• Machine and non-human identity experience, including service accounts, workload identity, and scoped, revocable, auditable access for AI agents.
• Experience building AI-native applications or applying LLMs and agent frameworks to production problems.
• Agile, Scrum, or Extreme Programming experience.
• GitHub portfolio or open-source contributions.

Culture & Benefits

• Hands-on engineering role focused primarily on coding and system design rather than coordination.
• Opportunity to define security approaches for emerging workforce agentic identity and AI authorization.
• Competitive compensation with pay-for-performance rewards, potential cash bonus, equity rewards, and benefits.
• Emphasis on measurable outcomes, continuous improvement, security rigor, and cross-functional collaboration.